Multiple vulnerabilities affecting Veeam Backup & Replication

Veeam Backup & Replication is a data backup, recovery and replication solution for virtual, physical and cloud environments. This solution is affected by several vulnerabilities labeled as follows: CVE-2026-21666 & CVE-2026-21667 & CVE-2026-21669: These vulnerabilities result from poor access management that would allow a malicious actor with an authenticated domain account to execute arbitrary commands on the affected backup server. They are classified critical with a severity score of 9.9 according to CVSS v3.1. CVE-2026-21668: This vulnerability is due to a file access control flaw. It would allow an authenticated malicious actor to bypass restrictions and manipulate files in the Backup Repository. It is classified high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-21672: This vulnerability results from insufficient management of local privileges on Veeam servers under Windows. Exploitation of this vulnerability would allow an authenticated malicious actor to elevate their privileges to the SYSTEM level. It is classified high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-21708: This vulnerability would allow a malicious actor with the “Backup Viewer” role to execute arbitrary code on affected systems as the postgres user. It is classified critical with a severity score of 9.9 according to CVSS v3.1. CVE-2026-21670: This vulnerability is caused by insufficient protection of sensitive data within Veeam Windows servers, and would allow a low-privileged attacker to extract stored SSH credentials. It is classified high with a severity score of 7.7 according to CVSS v3.1. CVE-2026-21671: This vulnerability results from a flaw in high availability (HA) deployments within Veeam software. It would allow an authenticated malicious actor with the “Backup Administrator” role to execute code remotely. It is classified critical with a severity score of 9.1 according to CVSS v3.1.

• Veeam Backup & Replication 12.3.2 versions prior to 12.3.2.4465;
• Veeam Backup & Replication 13.0 versions prior to 13.0.1.2067;