PT-2026-24955 · Veeam · Veeam Backup & Replication

Published 2026-03-12 · Updated 2026-05-10 · CVE-2026-21669

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veeam Backup and Replication (affected versions not specified)

Description The software contains a flaw that allows a user with domain access to execute code remotely on the Backup Server. The issue enables remote code execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Protection Mechanism Failure

Code Injection

Improper Access Control

Weakness Enumeration

CWE-693

CWE-94

CWE-284

Related Identifiers

BDU:2026-05182

CVE-2026-21669

Affected Products

Veeam Backup & Replication

References · 14

• https://veeam.com/kb4831 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05182 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21669 · Security Note
• https://twitter.com/TheHackerWire/status/2032128611676012736 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2032269767696859350 · Twitter Post
• https://twitter.com/CVEnew/status/2032410956320686353 · Twitter Post
• https://twitter.com/CveFindCom/status/2032120258367041780 · Twitter Post
• https://t.me/true_secator/7993 · Telegram Post
• https://twitter.com/anonhaven_com/status/2032440578009354270 · Twitter Post
• https://t.me/cveNotify/162945 · Telegram Post
• https://twitter.com/ptdbugs/status/2032383509847753019 · Twitter Post
• https://twitter.com/johndjohnson/status/2032812264613621777 · Twitter Post
• https://reddit.com/r/KibernetinisSaugumas/comments/1rsmzj1/atsargin%C4%97s_kopijos_pavojuje_veeam_software · Reddit Post
• https://reddit.com/r/Action1/comments/1rxzfhr/action1_incorrectly_identifying_veeam_br_12324165 · Reddit Post