# Veeam Backup & Replication 8 Critical Vulnerabilities — Domain User to Backup Server RCE (CVE-2026-21666, CVE-2026-21667, CVE-2026-21669, CVE-2026-21708)

> Veeam disclosed 8 security vulnerabilities in Backup & Replication on March 12, 2026, including four critical RCE flaws (CVE-2026-21666, CVE-2026-21667, CVE-2026-21669 at CVSS 9.9, and CVE-2026-21708 at CVSS 9.9) that allow low-privileged domain users or Backup Viewer role holders to execute remote code on backup servers. Historical exploitation of Veeam CVEs by FIN7, Cuba, Akira, and BlackBasta ransomware groups makes immediate patching critical.

- **Published:** 2026-03-15T12:00:00Z
- **Last reviewed:** 2026-03-15T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0232
- **ID:** TL-2026-0232
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** FIN7 (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21666, CVE-2026-21667, CVE-2026-21669, CVE-2026-21708, CVE-2026-21671, CVE-2026-21668, CVE-2026-21672, CVE-2026-21670

## Description

On March 12, 2026, Veeam published security advisories KB4830 (v12) and KB4831 (v13) disclosing eight vulnerabilities in Veeam Backup & Replication, their flagship enterprise backup solution. Four of these are rated critical with CVSS 9.9 scores.

The most severe vulnerabilities — CVE-2026-21666, CVE-2026-21667, and CVE-2026-21669 — allow any authenticated domain user to achieve remote code execution on the Veeam Backup Server with low attack complexity and no user interaction required. The scope is changed (S:C), meaning compromise extends beyond the vulnerable component to the broader backup infrastructure. CVE-2026-21708 allows a user with the Backup Viewer role to execute code as the postgres database user, representing a significant privilege boundary violation.

Additional high-severity flaws include CVE-2026-21671 (CVSS 9.1) enabling RCE in high-availability deployments for Backup Administrators, CVE-2026-21668 (CVSS 8.8) allowing arbitrary file manipulation on backup repositories, CVE-2026-21672 (CVSS 8.8) enabling local privilege escalation on Windows servers, and CVE-2026-21670 (CVSS 7.7) permitting extraction of saved SSH credentials.

Veeam Backup & Replication is widely deployed across enterprise environments with over 550,000 customers globally. Backup servers are high-value targets for ransomware operators because destroying or encrypting backups eliminates the victim's recovery capability, increasing ransom payment likelihood. The Veeam Backup Service listens on TCP port 9392, while the REST API operates on TCP port 9401 — both represent network-accessible attack surfaces.

Historically, Veeam vulnerabilities have been rapidly weaponized: CVE-2023-27532 was exploited by FIN7 and Cuba ransomware within weeks of disclosure, and CVE-2024-40711 was leveraged by Akira ransomware operators. Domain-joined Veeam backup servers inherit the risk posture of the Active Directory domain, meaning any compromised domain user account can potentially reach these critical CVSS 9.9 RCE vulnerabilities.

All vulnerabilities were discovered through internal testing or reported via HackerOne. No public proof-of-concept exploits or active exploitation have been confirmed as of March 15, 2026, but the pattern of rapid post-disclosure weaponization for Veeam vulnerabilities makes proactive patching essential. Veeam recommends isolating backup servers from production domains and applying updates to version 12.3.2.4465 (v12) or 13.0.1.2067 (v13) immediately.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1486 Data Encrypted for Impact
- T1071 Application Layer Protocol
- T1046 Network Service Discovery
- T1018 Remote System Discovery

## Sources

- [Veeam Security Bulletin KB4830 — Vulnerabilities Resolved in v12.3.2.4465](https://www.veeam.com/kb4830)
- [Veeam Security Bulletin KB4831 — Vulnerabilities Resolved in v13.0.1.2067](https://www.veeam.com/kb4831)
- [NVD — CVE-2026-21666](https://nvd.nist.gov/vuln/detail/CVE-2026-21666)
- [Veeam Patches 7 Critical Backup & Replication Flaws — The Hacker News](https://thehackernews.com/2026/03/veeam-patches-7-critical-backup.html)
- [Veeam warns of critical flaws exposing backup servers to RCE attacks — BleepingComputer](https://www.bleepingcomputer.com/news/security/veeam-warns-of-critical-flaws-exposing-backup-servers-to-rce-attacks/)
- [SOCRadar — Veeam Backup & Replication CVE-2026-21666 and Related RCE Fixes](https://socradar.io/blog/veeam-backup-replication-cve-2026-21666/)
- [Arctic Wolf — Multiple Authenticated Vulnerabilities in Veeam Backup & Replication](https://arcticwolf.com/resources/blog/multiple-authenticated-high-and-critical-vulnerabilities-veeam-backup-replication/)
- [Veeam CVE — Why Backup Infrastructure Has Become Dangerous — Penligent](https://www.penligent.ai/hackinglabs/veeam-cve-why-backup-infrastructure-has-become-one-of-the-most-dangerous-places-to-be-wrong/)
- [CSO Online — Veeam warns admins to patch now as critical RCE flaws hit Backup & Replication](https://www.csoonline.com/article/4144882/veeam-warns-admins-to-patch-now-as-critical-rce-flaws-hit-backup-replication.html)
- [Veeam Patches Multiple Critical RCE Vulnerabilities — CyberSecurity News](https://cybersecuritynews.com/veeam-backup-server-vulnerabilities/)
- [Veeam patches critical RCE vulnerabilities — SC Media](https://www.scworld.com/brief/veeam-patches-critical-rce-vulnerabilities-in-backup-software)
- [runZero — Veeam RCE vulnerabilities: How to find impacted assets](https://www.runzero.com/blog/veeam-instances/)
- [Cuba ransomware uses Veeam exploit against critical U.S. organizations — BleepingComputer (Historical)](https://www.bleepingcomputer.com/news/security/cuba-ransomware-uses-veeam-exploit-against-critical-us-organizations/)
- [Veeam KB3103 — List of Security Fixes and Improvements](https://www.veeam.com/kb3103)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0232