Cyber Posture

CVE-2026-21669

Critical

Published: 12 March 2026

Published
12 March 2026
Modified
31 March 2026
KEV Added
—
Patch
—
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0029 52.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2026-21669 by requiring timely remediation of the code injection flaw through patching as specified in the vendor advisory.

SI-10 Information Input Validation good match
prevent

Prevents code injection (CWE-94) exploitation by enforcing validation of all information inputs to the Backup Server, blocking arbitrary code execution.

AC-6 Least Privilege partial match
prevent

Limits the impact of successful RCE by ensuring low-privilege domain users and processes have only necessary access rights on the Backup Server.

Security SummaryAI

CVE-2026-21669 is a code injection vulnerability (CWE-94) that enables an authenticated domain user to execute arbitrary code remotely on the affected Backup Server. Published on 2026-03-12, it carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and potential for high-impact privilege escalation across security scopes.

An attacker requires only valid low-privilege domain user credentials to exploit the vulnerability over the network without user interaction. Successful exploitation grants remote code execution on the Backup Server, allowing full control over the system, including potential data exfiltration, modification, or disruption.

Mitigation details are provided in the vendor advisory at https://www.veeam.com/kb4831.

Details

CWE(s)
CWE-94

Affected Products

veeam
veeam backup \& replication
13.0.0.496 — 13.0.1.2067

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Code injection vulnerability enables authenticated remote code execution on Backup Server, directly facilitating T1210 (Exploitation of Remote Services) for initial access/escalation and T1068 (Exploitation for Privilege Escalation) due to low-priv to full system control.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References