Vulnerabilities & Exploits · Zero-Day Exploit

Critical RCE Flaws Found in Veeam Backup & Replication

The issues allow low-privileged domain users and a Backup Viewer role to execute code on backup servers.

2 sources · Mar 13

CVEs in this update

7 CVEs

5 critical · 2 high · 0 medium · 0 low

0 in CISA KEV · 0 with EPSS above 1%

Highest severity: CVE-2026-21666 · 9.9 CRITICAL

Timeline

• Mar 13 Reported by The Hacker News
• Mar 12 Reported by BleepingComputer

Sources

• Mar 13 The Hacker News

  Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

  Veeam fixes 7 Backup & Replication flaws, including CVSS 9.9 RCE bugs, warning attackers may exploit unpatched systems.

  original

• Mar 12 BleepingComputer

  Veeam warns of critical flaws exposing backup servers to RCE attacks

  Data protection company Veeam Software has patched multiple flaws in its Backup & Replication solution, including four critical remote code execution (RCE) vulnerabilities.

  original

Part of the PlainSec briefing for 2026-03-14

Every edition of this story: Critical RCE Flaws Found in Veeam Backup & Replication

More from today

• CISA Orders Emergency Patches for SolarWinds, Ivanti, Workspace One
• Attackers Shift to RCE Bugs to Compromise Clouds
• ChromeOS LTS Update Addresses Three High Vulnerabilities