CVE-2026-21708

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-12 · updated 2026-06-17
Weakness: CWE-89

Description

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Summary

CVE-2026-21708 is a critical flaw (CVSS 9.9) in Veeam Backup & Replication that lets a Backup Viewer achieve remote code execution as the postgres user. It is fixed in version 12.3.2.4465. There is no known exploitation: it is not in CISA KEV, SSVC exploitation status is none, and EPSS 30-day probability is 1.1%. Upgrade to 12.3.2.4465 or later; until then, limit Backup Viewer access to trusted accounts.

CVE-2026-21708 ثغرة حرجة (CVSS 9.9) في Veeam Backup & Replication تتيح لمستخدم Backup Viewer تنفيذ تعليمات برمجية عن بُعد بصلاحيات مستخدم postgres. تم إصلاحها في الإصدار 12.3.2.4465. لا يوجد استغلال معروف: الثغرة ليست في CISA KEV، وحالة الاستغلال وفق SSVC هي none، واحتمال الاستغلال خلال 30 يومًا وفق EPSS هو 1.1%. يُنصح بالترقية إلى 12.3.2.4465 أو أحدث، وإلى حين ذلك تقييد وصول Backup Viewer للحسابات الموثوقة فقط.

Affected products

Veeam Backup & Replication: from 12.0.0.1402 before 12.3.2.4465. — fixed in 12.3.2.4465.

How to fix

Upgrade to a fixed version: Veeam Backup & Replication 12.3.2.4465.. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-21708 or the next vulnerability affects your stack