Veeam Patches Multiple Critical RCE Vulnerabilities on Backup Server

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Veeam Patches Critical RCE Vulnerabilities in Backup & Replication Software Veeam Software has released a critical security update for its Backup & Replication platform to address multiple vulnerabilities, including three severe remote code execution (RCE) flaws. These vulnerabilities, tracked as CVE-2026-21666, CVE-2026-21667, and CVE-2026-21708, allow authenticated users to execute arbitrary code on backup servers. The flaws affect Veeam Backup & Replication versions 12.3.2.4165 and earlier, with the patch available in version 12.3.2.4465. In total, the update resolves seven security issues, including two high-severity vulnerabilities that enable file manipulation and privilege escalation. Veeam has urged organizations to apply the update promptly, as attackers often exploit vulnerabilities shortly after patches are released. The vulnerabilities were reported through Veeam's bug bounty program and discovered during internal testing. Backup systems are increasingly targeted by attackers, particularly ransomware operators, due to their critical role in data recovery. 16 sources 73