Loading vulnerability…
Authenticated RCE in Veeam Backup & Replication HA Deployments
CVE-2026-21671 is a critical remote code execution vulnerability affecting high-availability (HA) deployments of Veeam Backup & Replication 13 before version 13.0.1.2067. An authenticated user with the Backup Administrator role can exploit the vulnerability to execute code remotely within the affected deployment. The vulnerability has a reported CVSS score of 9.1. The underlying flaw, vulnerable function, and execution security context are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote code execution within an affected HA deployment, potentially compromising the confidentiality, integrity, and availability of the backup infrastructure. The privileges of the executed code and the extent of access to backup data are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting assignment of the Backup Administrator role, restricting access to HA management and administrative interfaces to only trusted administrators, and minimizing the number of authenticated users who can reach the affected environment. Additional compensating controls should focus on strong access control, segmentation of backup infrastructure, and close monitoring of privileged activity until the fixed version is deployed.
Patch, then assume compromise.
Upgrade Veeam Backup & Replication to version 13.0.1.2067 or a later release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.