CVE-2026-21672 is a local privilege escalation vulnerability affecting Veeam Backup and Replication versions 12 and 13 on Windows platforms. It involves improper exposure of file and directory information (CWE-538), which can be leveraged by a local attacker with limited privileges to escalate their access rights. The vulnerability has a high CVSS score of 8.8, reflecting its potential to compromise confidentiality, integrity, and availability of the affected system. No patches or official fixes have been documented yet, and no exploits are currently known to be active in the wild.

Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on the affected Veeam Backup and Replication server, potentially leading to full system compromise. This could impact the confidentiality, integrity, and availability of backup data and the backup infrastructure. However, exploitation requires local access, limiting the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to Veeam Backup and Replication servers and monitor for suspicious activity. Follow vendor communications closely for updates on patches or temporary mitigations.