High

Remote Code Execution in Veeam Backup & Replication Backup Server

IdentifiersCVE-2026-21667

CVE-2026-21667 is a critical remote code execution vulnerability in Veeam Backup & Replication affecting version 12.3.2.4165 and all earlier version 12 builds. The issue allows an authenticated domain user, including a low-privileged domain user, to execute code remotely on the Veeam Backup Server. The specific vulnerable function or code path is not provided in the available content, but the flaw is described as exploitable in a low-complexity attack and capable of leading to full system compromise of the backup server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote code execution on the Veeam Backup Server by an authenticated domain user. Given the role of the backup server and the reporting context, this can result in full system compromise, access to sensitive backup infrastructure, potential lateral movement, disruption of recovery operations, and abuse of backup data or server trust relationships within the environment.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of the Veeam Backup Server by limiting access to trusted administrators and minimizing the ability of ordinary domain users to authenticate to or reach the server. Restrict network access to management interfaces and related services, review domain-user access paths to backup infrastructure, and monitor closely for suspicious activity targeting Veeam systems. However, the vendor guidance in the provided content is to patch immediately, and no complete workaround is described.

Remediation

Patch, then assume compromise.

Upgrade Veeam Backup & Replication to a fixed release. The available content states that Veeam fixed CVE-2026-21667 in version 12.3.2.4465. Systems running version 12.3.2 builds 12.3.2.3617 or 12.3.2.4165 can apply the dedicated patch provided by Veeam, while organizations running version 12.3.1 or earlier must upgrade using the full installation ISO to build 12.3.2.4465. Veeam advised administrators to apply the patch immediately.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Veeam SoftwareVeeam Backup & Replicationapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

Mar 13, 2026

Veeam Security Patch Fixes Critical RCE In Backup Platform

A critical remote code execution vulnerability in Veeam Backup & Replication that allows an authenticated domain user to achieve remote code execution on the Backup Server.

cyber security newsNews

Mar 13, 2026

Veeam Patches Multiple Critical RCE Vulnerabilities on Backup Server

A critical remote code execution vulnerability in Veeam Backup & Replication that allows an authenticated domain user to trigger RCE on the Backup Server, potentially leading to full system compromise.

the hacker newsNews

Mar 13, 2026

Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

A critical remote code execution vulnerability in Veeam Backup & Replication that allows an authenticated domain user to execute code on the Backup Server.

bleeping computerNews

Mar 12, 2026

Veeam warns of critical flaws exposing backup servers to RCE attacks

A critical remote code execution vulnerability in Veeam Backup & Replication that allows low-privileged domain users to execute code remotely against vulnerable backup servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity9