High

Local Privilege Escalation in Windows-based Veeam Backup & Replication Servers

IdentifiersCVE-2026-21672CWE-269

CVE-2026-21672 is a local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers. According to the provided content, the flaw allows an attacker with limited local access or low privileges on the host to elevate privileges on the system. The CVSS v3.1 vector provided for the CVE is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity local attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability. The specific vulnerable function or code path is not identified in the provided material.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a low-privileged local attacker to escalate privileges on the affected Windows Veeam Backup & Replication server. Given the CVSS vector and the role of the affected system, this can result in high-impact compromise of confidentiality, integrity, and availability on the host, including effective administrative or SYSTEM-level control over backup infrastructure components and the data and operations they manage.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce local access to Windows-based Veeam Backup & Replication servers to only trusted administrators and tightly restrict interactive logon and remote management paths. Minimize the number of low-privileged accounts with local access, monitor for suspicious privilege escalation activity on Veeam servers, and prioritize these systems for emergency change windows because Veeam warned that attackers may reverse-engineer patches to target unpatched deployments. Specific vendor-provided workaround details beyond patching are not available in the provided content.

Remediation

Patch, then assume compromise.

Apply Veeam's security update that remediates CVE-2026-21672. The provided content states that Veeam fixed this issue in Veeam Backup & Replication build 12.3.2.4465 for affected version 12 deployments, and that version 13.0.1.2067 also includes a fix for this vulnerability. Organizations running version 12.3.2 builds 12.3.2.3617 or 12.3.2.4165 can apply the dedicated patch referenced by Veeam KB4830, while organizations running 12.3.1 or earlier must upgrade using the full installation ISO to 12.3.2.4465. Veeam advises administrators to apply the patch immediately.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Veeam SoftwareBackup & Replicationapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

Mar 13, 2026

Veeam Security Patch Fixes Critical RCE In Backup Platform

A high-severity local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers.

cyber security newsNews

Mar 13, 2026

Veeam Patches Multiple Critical RCE Vulnerabilities on Backup Server

A high-severity local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers that allows an attacker with limited local access to elevate privileges.

the hacker newsNews

Mar 13, 2026

Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

A local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers.

cvefeed high severityNews

Mar 12, 2026

CVE-2026-21672 - Veeam Backup & Replication Windows Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5