Cyber Posture

CVE-2026-21667

Critical

Published: 12 March 2026

Published
12 March 2026
Modified
31 March 2026
KEV Added
—
Patch
—
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0035 57.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching of the Veeam Backup Server vulnerability, directly preventing RCE exploitation by authenticated domain users.

AC-3 Access Enforcement partial match
prevent

Access enforcement directly addresses the improper access control (CWE-284) flaw enabling low-privilege users to achieve RCE on the backup server.

AC-6 Least Privilege partial match
prevent

Least privilege limits the access of authenticated domain users to the backup server, reducing the attack surface for this RCE vulnerability.

Security SummaryAI

CVE-2026-21667 is a critical vulnerability in the Veeam Backup Server that enables an authenticated domain user to execute remote code (RCE). Classified under CWE-284 (Improper Access Control), it carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and potential for complete confidentiality, integrity, and availability compromise with a changed scope.

An attacker with low-privilege access as an authenticated domain user can exploit this vulnerability remotely without user interaction. Successful exploitation grants arbitrary code execution on the Backup Server, potentially allowing full system compromise, data exfiltration, or lateral movement within the environment.

Veeam has published mitigation guidance in knowledge base article KB4830, available at https://www.veeam.com/kb4830. Security practitioners should consult this advisory for patching instructions and workarounds to address the vulnerability.

Details

CWE(s)
CWE-284

Affected Products

veeam
veeam backup \& replication
12.0.0.1402 — 12.3.2.4465

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CVE enables remote code execution on Veeam Backup Server via improper access control for authenticated low-privilege domain users, directly facilitating Exploitation of Remote Services (T1210) and Exploitation for Privilege Escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References