CYBERSECURITYMarch 13, 20261 min read17 views

Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

Veeam has released security updates for seven critical vulnerabilities in its Backup & Replication software, some with a CVSS score of 9.9, which could allow remote code execution.

Veeam has released security updates to address multiple critical vulnerabilities in its Backup & Replication software that, if successfully exploited, could result in remote code execution.

The vulnerabilities are as follows -

CVE-2026-21666(CVSS score: 9.9) - A vulnerability that allows an authenticated domain user to perform remote code execution on the Backup Server.CVE-2026-21667(CVSS score: 9.9) - A vulnerability that allows an authenticated domain user to perform remote code execution on the Backup Server.CVE-2026-21668(CVSS score: 8.8) - A vulnerability that allows an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.CVE-2026-21672(CVSS score: 8.8) - A vulnerability that allows local privilege escalation on Windows-based Veeam Backup & Replication servers.CVE-2026-21708(CVSS score: 9.9) - A vulnerability that allows a Backup Viewer to perform remote code execution as the postgres user.

The shortcomings, which affect Veeam Backup & Replication 12.3.2.4165 and all earlier version 12 builds, have been addressed in version 12.3.2.4465. CVE-2026-21672 and CVE-2026-21708 have also been fixed in Backup & Replication 13.0.1.2067, along with two more critical security flaws -

CVE-2026-21669(CVSS score: 9.9) - A vulnerability that allows an authenticated domain user to perform remote code execution on the Backup Server.CVE-2026-21671(CVSS score: 9.1) - A vulnerability that allows an authenticated user with the Backup Administrator role to perform remote code execution in high availability (HA) deployments of Veeam Backup & Replication.

"It's important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software," the company said in its advisory.

With vulnerabilities in Veeam software having been repeatedly exploited by threat actors to carry out ransomware attacks in the past, it's essential that users update their instances to the latest version to safeguard against any potential threat.

Source: The Hacker News

More in this category

cybersecurity

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a massive campaign named FakeGit, leveraging thousands of malicious GitHub repositories to distribute SmartLoader malware. The campaign features a novel technique called AgentBaiting, which tricks AI agents into executing malicious instructions autonomously.

cybersecurity

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A mere 11-byte TLS request can force an unpatched OpenSSL server to allocate up to 131 KB of memory that is never released. OpenSSL silently patched this "HollowByte" vulnerability without issuing a CVE or security advisory.

cybersecurity

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

cybersecurity

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog, which compromised DigiCert's support portal to steal and abuse code-signing certificates.

cybersecurity

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia has detained a Russian tourist on a U.S. extradition warrant targeting a REvil ransomware suspect. However, defense lawyers argue it is a case of mistaken identity caused by incomplete name details in the U.S. warrant.

cybersecurity

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an active infostealer, is targeting enterprise networks using sophisticated 'ClickFix' social engineering lures. By tricking users into pasting malicious commands into the Run dialog, attackers can easily steal session tokens, browser credentials, and sensitive documents from OneDrive and SharePoint.