PT-2026-25006 · Veeam · Backup/Recovery

Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-21708

X.com · Ptdbugs

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE: CVE-2026-21708 Vendor: Veeam Product: Backup and Recovery CVSS: 10.0 Credits: n/a

Description: A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

References: • https://t.co/7NKLs529Ud • https://t.co/jA4BK17Xlf • https://t.co/IOPABZq4vT

#dbugs vuln

Fix

Related Identifiers

CVE-2026-21708

Affected Products

Backup/Recovery

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-21708 · Security Note
• https://twitter.com/anonhaven_com/status/2032440578009354270 · Twitter Post
• https://twitter.com/CVEnew/status/2032230712032510432 · Twitter Post
• https://t.me/CVEtracker/47264 · Telegram Post
• https://twitter.com/0dayPublishing/status/2032138057294471533 · Twitter Post
• https://t.me/true_secator/7993 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2032269767696859350 · Twitter Post
• https://twitter.com/CveFindCom/status/2032150324039876978 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2032292480259903573 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rstnim/veeam_alerts_critical_rce_flaws_in_backup · Reddit Post
• https://veeam.com/kb4830 · Note
• https://twitter.com/securityRSS/status/2032495259511386579 · Twitter Post
• https://twitter.com/ptdbugs/status/2032383757517271426 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032143793970159884 · Twitter Post
• https://veeam.com/kb4831 · Note