Skip to main content

Veeam Releases Security Updates for Backup & Replication

Security bulletin addresses vulnerabilities that could allow for remote code execution and privilege escalation

Threat ID:
CC-4754
Threat Severity:
Medium
Published:
12 March 2026 2:19 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security bulletin addresses vulnerabilities that could allow for remote code execution and privilege escalation

Affected platforms

The following platforms are known to be affected:

Versions: 12.3.2.4165 and all earlier version 12 builds

Veeam Backup & Replication

Threat details

Unsupported versions should be considered vulnerable

Veeam states, "Unsupported product versions are not tested, but are likely affected and should be considered vulnerable".

Introduction

Veeam has released a security bulletin to address three critical vulnerabilities in Backup & Replication.

  • CVE-2026-21666 - Authenticated Remote Code Execution vulnerability - CVSSv3: 9.9
  • CVE-2026-21667 - Authenticated Remote Code Execution vulnerability - CVSSv3: 9.9
  • CVE-2026-21708 - Authenticated Remote Code Execution vulnerability  - CVSSv3: 9.9

The security bulletin also addresses two high severity vulnerabilities.

Remediation advice

Affected organisations are strongly encouraged to review Veeam Security Bulletin KB4830 and apply the relevant update as soon as possible.

Definitive source of threat updates

Last edited: 12 March 2026 2:19 pm