PT-2026-25006 · Veeam · Backup/Recovery+1

Publicado 2026-03-12 · Atualizado 2026-05-10 · CVE-2026-21708

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Veeam Backup and Recovery (affected versions not specified)

Description A flaw exists that allows a Backup Viewer to execute code remotely as the postgres user. This issue has a CVSS score of 10.0 and is considered critical. The vulnerability could allow for remote code execution, potentially impacting backup infrastructure. No information is available regarding the number of affected devices or real-world incidents. The vulnerability affects the functionality related to Backup Viewers and their interaction with the postgres user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-21708

Produtos afetados

Backup/Recovery

Backup/Replication

Referências · 19

• https://twitter.com/the_yellow_fall/status/2032292480259903573 · Publicação no Twitter
• https://twitter.com/securityRSS/status/2032495259511386579 · Publicação no Twitter
• https://veeam.com/kb4830 · Nota
• https://t.me/true_secator/7993 · Publicação no Telegram
• https://t.me/CVEtracker/47264 · Publicação no Telegram
• https://twitter.com/ptdbugs/status/2032383757517271426 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/2032269767696859350 · Publicação no Twitter
• https://twitter.com/integ_sec/status/2035009729127207174 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2032150324039876978 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2032143793970159884 · Publicação no Twitter
• https://veeam.com/kb4831 · Nota
• https://twitter.com/0dayPublishing/status/2032138057294471533 · Publicação no Twitter
• https://reddit.com/r/KibernetinisSaugumas/comments/1rsmzj1/atsargin%C4%97s_kopijos_pavojuje_veeam_software · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-21708 · Nota de Segurança
• https://reddit.com/r/Veeam/comments/1rz7cw2/veeam_backup_replication_cve202621708 · Publicação no Reddit