Loading vulnerability…
Local Privilege Escalation in Veeam Backup & Replication for Windows
CVE-2026-21672 is a local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers. An attacker with low-privileged local access can elevate privileges without user interaction. Affected releases include version 12.3.2.4165 and earlier 12.x builds, and version 13.0.1.1071 and earlier 13.x builds. The vulnerability is rated high severity with a CVSS v3.1 score of 8.8 and vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerable function and underlying technical mechanism are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables local privilege escalation on the affected backup server. The CVSS assessment indicates high impacts to confidentiality, integrity, and availability, with changed scope. The exact privileges obtained and resources accessible after exploitation are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting local interactive and remote access to Veeam Backup & Replication servers, minimizing the number of users and services with logon rights, enforcing least privilege, and monitoring for anomalous privilege escalation activity on backup servers. Because exploitation requires local access, isolating backup infrastructure and restricting administrative pathways can reduce risk until vendor fixes are applied.
Patch, then assume compromise.
Upgrade Veeam Backup & Replication to version 12.3.2.4465 or later in the 12.x branch, or version 13.0.1.2067 or later in the 13.x branch. For 12.x deployments, builds 12.3.2.3617 and 12.3.2.4165 support a dedicated patch; deployments running 12.3.1 or earlier require the full installation ISO to upgrade to 12.3.2.4465.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.