Vulnerabilities · 231 days ago

Critical RCE flaws found in Veeam Backup & replication

The issues allow low-privileged domain users and a Backup Viewer role to execute code on backup servers.

CVEs in this update

7 CVEs

Across Backup and Replication, veeam backup & replication, Software Appliance.

5 critical · 2 high · 0 medium · 0 low

0 in CISA KEV · 0 with EPSS above 1%

Highest severity: CVE-2026-21666 · 9.9 CRITICAL

Timeline

• Mar 13 Reported by The Hacker News
• Mar 12 Reported by BleepingComputer

Sources

2 sources covering this story

• The Hacker News Mar 13

  Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

  Veeam fixes 7 Backup & Replication flaws, including CVSS 9.9 RCE bugs, warning attackers may exploit unpatched systems.

• BleepingComputer Mar 12

  Veeam warns of critical flaws exposing backup servers to RCE attacks

  Data protection company Veeam Software has patched multiple flaws in its Backup & Replication solution, including four critical remote code execution (RCE) vulnerabilities.

Entities

• CVE-2026-21666
• CVE-2026-21667
• CVE-2026-21668
• CVE-2026-21672

Part of the PlainSec briefing for 2026-03-14

Editions

• Briefing for 2026-03-14
• Briefing for 2026-03-13

Related stories

• CISA orders emergency patches for SolarWinds, Ivanti, Workspace One
• Attackers shift to RCE bugs to compromise clouds
• ChromeOS LTS update addresses three high vulnerabilities