This vulnerability (CVE-2026-21708) is a SQL Injection flaw classified under CWE-89 in Veeam Backup and Replication products, specifically versions 12 and 13. It enables an attacker with Backup Viewer access to perform remote code execution with the privileges of the postgres user. The CVSS 3.1 base score of 9.9 reflects network attack vector, low attack complexity, required privileges at the level of a Backup Viewer, no user interaction, and complete impact on confidentiality and integrity with limited impact on availability. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation information at this time.

Successful exploitation allows an attacker with Backup Viewer privileges to execute arbitrary code remotely as the postgres user, which can lead to full compromise of the backup system and potentially affect data confidentiality and integrity. The critical CVSS score (9.9) indicates severe impact, including high confidentiality and integrity loss and some availability impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Backup Viewer privileges to trusted users only and monitor for unusual activity related to database access. Avoid exposing the backup management interface to untrusted networks. Follow vendor channels closely for updates and apply patches immediately once available.