PT-2026-25006 · Veeam · Backup/Recovery+1

Published 2026-03-12 · Updated 2026-05-10 · CVE-2026-21708

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Veeam Backup and Recovery (affected versions not specified)

Description A flaw exists that allows a Backup Viewer to execute code remotely as the postgres user. This issue has a CVSS score of 10.0 and is considered critical. The vulnerability could allow for remote code execution, potentially impacting backup infrastructure. No information is available regarding the number of affected devices or real-world incidents. The vulnerability affects the functionality related to Backup Viewers and their interaction with the postgres user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-21708

Affected Products

Backup/Recovery

Backup/Replication

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-21708 · Security Note
• https://twitter.com/the_yellow_fall/status/2032292480259903573 · Twitter Post
• https://twitter.com/securityRSS/status/2032495259511386579 · Twitter Post
• https://veeam.com/kb4830 · Note
• https://t.me/true_secator/7993 · Telegram Post
• https://t.me/CVEtracker/47264 · Telegram Post
• https://twitter.com/ptdbugs/status/2032383757517271426 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2032269767696859350 · Twitter Post
• https://twitter.com/integ_sec/status/2035009729127207174 · Twitter Post
• https://twitter.com/CveFindCom/status/2032150324039876978 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032143793970159884 · Twitter Post
• https://veeam.com/kb4831 · Note
• https://twitter.com/0dayPublishing/status/2032138057294471533 · Twitter Post
• https://reddit.com/r/KibernetinisSaugumas/comments/1rsmzj1/atsargin%C4%97s_kopijos_pavojuje_veeam_software · Reddit Post
• https://reddit.com/r/Veeam/comments/1rz7cw2/veeam_backup_replication_cve202621708 · Reddit Post