Table of Contents
Are You Safe from the Latest Veeam Backup and Replication 13 Security Risks?
Urgent Security Updates for Veeam Backup Systems
Veeam issued critical security advisories on March 11, 2026. The alerts address severe vulnerabilities in Veeam Backup & Replication versions 12 and 13. Several flaws carry a Maximum Common Vulnerability Scoring System (CVSS) score of 9.9. The German Federal Office for Information Security (BSI) subsequently issued formal warning WID-SEC-2026-0709 to alert administrators. System administrators must apply the provided software patches immediately to maintain infrastructure integrity.
Critical Flaws in Veeam Version 12
Veeam published security advisory KB4830 on March 12, 2026. This technical document identifies multiple vulnerabilities affecting Veeam Backup & Replication version 12.3.2.4165 and older deployments. Administrators resolve these specific risks by updating systems to version 12.3.2.4465.
- CVE-2026-21666 carries a 9.9 CVSS score and allows authenticated domain users to execute remote code on the backup server.
- CVE-2026-21667 carries a 9.9 CVSS score and grants authenticated domain users remote code execution capabilities.
- CVE-2026-21668 carries an 8.8 CVSS score and enables authenticated users to bypass restrictions to manipulate arbitrary files in repositories.
- CVE-2026-21672 carries an 8.8 CVSS score and permits local users to escalate privileges on Windows-based servers.
- CVE-2026-21708 carries a 9.9 CVSS score and allows Backup Viewers to execute remote code as PostgreSQL users.
Severe Vulnerabilities in Veeam Version 13
Veeam released security advisory KB4831 for version 13.0.1.1071 and earlier builds. Installing version 13.0.1.2067 patches these vulnerabilities completely. Internal testing teams discovered most of these flaws directly within the Windows-based applications and the Veeam Software Appliance.
- CVE-2026-21669 features a 9.9 CVSS score and enables authenticated domain users to perform remote code execution on Windows servers.
- CVE-2026-21670 features a 7.7 CVSS score and allows low-privileged users to extract stored SSH credentials.
- CVE-2026-21671 features a 9.1 CVSS score and allows Backup Administrators in high-availability environments to execute remote code.
- CVE-2026-21672 features an 8.8 CVSS score and facilitates local privilege escalation on Windows servers.
- CVE-2026-21708 features a 9.9 CVSS score and allows Backup Viewers to execute remote code as PostgreSQL users.
Additional Product Fixes
Veeam support article KB3103 outlines comprehensive security patches for older product iterations. This advisory covers Veeam Backup & Replication versions 10 through 13. Veeam Cloud Connect administrators also receive necessary patches for versions 10 through 12.3.
Veeam updated security advisory KB3109 to detail improvements for Veeam Agent for Linux. This specific update patches multiple open-source software components. The Linux agent fixes apply to versions 4.0 through 13.