Critical SEVERITY — Vulnerability

CVE-2026-21671 — A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE)

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

Platform
Veeam Backup & Replication
CVE Record
CVE-2026-21671
CVSS Score
9.1/10
Published
12 March 2026
Views
3
Primary source: Review the official advisory at nvd.nist.gov Kaynağa Git

Summary

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

Assessment

  • CVE: CVE-2026-21671
  • CVSS base score: 9.1
  • CVSS vector: CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H
  • Source: [NVD record](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-21671)

References

  • [www.veeam.com](https:\/\/www.veeam.com\/kb4831)

Action

  • Verify affected systems in inventory
  • Apply the vendor patch during a maintenance window
  • Restrict access at the network layer until the patch is applied
veeam backup \& replication *

Veeam Backup & Replication — Related Advisories

VIEW ALL →