CVE-2026-44963 is a critical vulnerability in Veeam Backup and Replication that allows remote code execution on the Backup Server by an authenticated domain user. The flaw is due to deserialization of untrusted data (CWE-502). It has a high CVSS 4.0 score of 9.4, indicating severe impact. No patch or official remediation guidance is currently provided by the vendor. The vulnerability requires low attack complexity and no user interaction but does require privileges of an authenticated domain user. No known exploits in the wild have been reported yet.
CVE-2026-32998 is a critical vulnerability in Veeam Service Provider Console involving improper handling of parameters (CWE-233) that allows remote code execution. The vulnerability has a high CVSS 4.0 score of 9.4, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. No patch or official remediation guidance is currently provided, and no known exploits are reported in the wild. The affected versions are unspecified. This vulnerability poses a significant risk of unauthorized code execution on affected systems.
CVE-2026-32997 is a high-severity vulnerability in Veeam Backup and Replication version 13 that allows an authenticated user with the Backup Administrator role to write arbitrary files on a Linux-based server. This is due to an absolute path traversal issue (CWE-36). The vulnerability does not require user interaction and has a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
CVE-2026-21666 is a critical remote code execution vulnerability in Veeam Backup and Replication version 12.3.2. It allows an authenticated domain user to execute arbitrary code on the Backup Server without user interaction. The vulnerability arises from improper access control (CWE-284), enabling privilege escalation and full system compromise. Exploitation requires low attack complexity and no user interaction, with a scope that affects confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the critical CVSS score of 10 highlights the urgent need for mitigation. Organizations relying on Veeam Backup and Replication for data protection are at significant risk. Immediate patching or compensating controls are essential to prevent potential attacks. Countries with high adoption of Veeam products and critical infrastructure relying on backups are most at risk.
CVE-2026-21667 is a critical vulnerability in Veeam Backup and Replication that allows an authenticated domain user to execute remote code on the Backup Server without user interaction. The flaw stems from improper access control (CWE-284), enabling privilege escalation and full system compromise. With a CVSS score of 10.0, this vulnerability impacts confidentiality, integrity, and availability severely. Although no known exploits are currently in the wild, the ease of exploitation and the critical nature of backup infrastructure make this a high-risk threat. Organizations relying on Veeam Backup and Replication should prioritize patching once available and implement strict access controls. Countries with significant Veeam market penetration and critical infrastructure reliance on backup solutions are at heightened risk. Immediate mitigation steps include restricting domain user permissions, monitoring for suspicious activity, and isolating backup servers from unnecessary network exposure.
This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a
malicious password parameter.
CVE-2025-55125 is a high-severity vulnerability in Veeam Backup and Recovery version 13.0.0 that allows a Backup or Tape Operator with limited privileges to execute arbitrary code remotely as root by crafting a malicious backup configuration file. The vulnerability stems from improper handling of configuration inputs, classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). Exploitation requires local access with Backup or Tape Operator privileges but does not require user interaction. The vulnerability impacts confidentiality, integrity, and availability, enabling full system compromise. No known exploits are currently in the wild, and no patches have been released yet. European organizations relying on Veeam Backup and Recovery 13.0.0 should prioritize risk assessment and implement strict access controls.
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.
