Veeam Exposes Backup Servers to Risk of Remote Code Execution Attacks

Veeam Software, a data protection company, has recently addressed multiple vulnerabilities in its Backup & Replication solution, including four critical remote code execution (RCE) flaws.

Backup & Replication (VBR) is a software used by IT administrators for enterprise data backup and recovery, enabling them to create data copies for quick restoration in case of cyberattacks or hardware failures.

The latest patches from Veeam address three RCE vulnerabilities (CVE-2026-21666, CVE-2026-21667, and CVE-2026-21669) that allow low-privileged domain users to execute remote code on vulnerable backup servers. Another vulnerability (CVE-2026-21708) permits a Backup Viewer to achieve remote code execution as the postgres user.

Additionally, Veeam has resolved several high-severity security issues that could be exploited to escalate privileges on Windows-based VBR servers, extract saved SSH credentials, and manipulate files on a Backup Repository.

These vulnerabilities were identified either through internal testing or reported via HackerOne and have been fixed in Veeam Backup & Replication versions 12.3.2.4465 and 13.0.1.2067.

Veeam urges administrators to promptly update their software to the latest version, as threat actors often start developing exploits soon after patches are released.

The company warns that attackers may attempt to reverse-engineer patches to target unpatched Veeam deployments, emphasizing the critical importance of keeping software up to date.

VBR Servers at Risk of Ransomware Attacks

Veeam’s Backup & Replication software is popular among managed service providers and medium to large enterprises, although ransomware groups frequently target VBR servers due to their potential as a launching point for lateral movement within compromised networks.

The financially motivated FIN7 group and the Cuba ransomware gang have been associated with previous attacks exploiting VBR vulnerabilities.

In November 2024, Sophos X-Ops incident responders revealed that the Frag ransomware leveraged a VBR RCE vulnerability disclosed earlier, also utilized in Akira and Fog ransomware attacks starting in October 2024.

Veeam boasts a customer base of over 550,000 worldwide, including 74% of Global 2,000 companies and 82% of Fortune 500 firms.