Loading vulnerability…
Backup Viewer Remote Code Execution in Veeam Backup & Replication
CVE-2026-21708 is a critical vulnerability in Veeam Backup & Replication that allows an authenticated user with the Backup Viewer role to execute arbitrary code remotely as the postgres user. Affected releases include version 12.3.2.4165 and earlier 12.x builds, and version 13.0.1.1071 and earlier 13.x builds. The vulnerability crosses the intended privilege boundary between the Backup Viewer role and the PostgreSQL execution context. Its CVSS v3.1 score is 9.9, with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerable function and underlying implementation defect have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality, integrity, and availability within the permissions available to the postgres user. An attacker can execute code outside the intended privileges of the Backup Viewer role, potentially accessing or modifying database information and disrupting backend database operations. Execution as an operating-system administrator or root is not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting assignment of the Backup Viewer role, restricting network access to Veeam Backup & Replication management interfaces to trusted administrative hosts and segments, and monitoring for anomalous activity involving the application and its PostgreSQL backend. These measures are compensating controls only; the primary mitigation is to apply the vendor fix.
Patch, then assume compromise.
Upgrade Veeam Backup & Replication 12.x deployments to version 12.3.2.4465 or later, or 13.x deployments to version 13.0.1.2067 or later. For 12.3.2 builds 12.3.2.3617 and 12.3.2.4165, Veeam provides a dedicated patch. Deployments running version 12.3.1 or earlier require the full installation ISO to upgrade to build 12.3.2.4465.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.