CRLF Injection RCE in Veeam Backup & Replication Backup Server

CVE-2026-21666 is a critical remote code execution vulnerability in Veeam Backup & Replication affecting the Backup Server. The flaw is caused by improper neutralization of carriage return and line feed (CRLF) sequences in user-supplied input processed through authenticated requests. According to the provided context, the vulnerable code path handles configuration parameters for connected Linux-based Backup Proxies or Hardened Repositories and dynamically constructs service execution files or environment-variable style directives from that input. Because newline-related escape sequences are not properly stripped or encoded, an authenticated domain user can inject CRLF characters to terminate an intended single configuration directive and introduce attacker-controlled directives. The supplied examples indicate this can include adding a pre-execution command in a systemd unit or similar service configuration context. When the manipulated configuration is written to disk or passed to process execution functions, the operating system executes the injected payload with the privileges of the affected service, resulting in RCE on the Veeam Backup Server.