CVE-2026-21667 is a critical remote code execution (RCE) vulnerability affecting Veeam Backup & Replication, enabling an authenticated domain user to execute arbitrary code on the backup server. Rated 8.8 HIGH on the CVSS scale, this flaw has a network attack vector and low attack complexity, requiring only low privileges but no user interaction, leading to high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV) and no public exploit code available, the vulnerability has garnered community attention and media coverage urging immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.0.0.1402, < 12.3.2.4465CPE matchmatch criteria | cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.