Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN298 _____________________________________________________________________ DATE : 12/03/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Veeam Backup & Replication versions prior to 12.3.2.4465, 13.0.1.2067. ===================================================================== https://www.veeam.com/kb4830 https://www.veeam.com/kb4831 _____________________________________________________________________ Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2.4465 KB ID: 4830 Product: Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 Published: 2026-03-12 Last Modified: 2026-03-12 All vulnerabilities documented in this article were resolved in Veeam Backup & Replication 12.3.2.4465. Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details All vulnerabilities disclosed in this article affect Veeam Backup & Replication 12.3.2.4165 and all earlier version 12 builds. CVE-2026-21666 A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. Severity: Critical CVSS v3.1 Score: 9.9 Source: Reported by HackerOne. CVE-2026-21667 A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. Severity: Critical CVSS v3.1 Score: 9.9 Source: Discovered during internal testing. CVE-2026-21668 A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. Severity: High CVSS v3.1 Score: 8.8 Source: Discovered during internal testing. CVE-2026-21672 A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. Severity: High CVSS v3.1 Score: 8.8 Source: Reported through HackerOne. CVE-2026-21708 A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. Severity: Critical CVSS v3.1 Score: 9.9 Source: Discovered during internal testing. Other Resolved Security-related Issues Veeam Agent for Linux — Updated the port range that the software will open in the machine's firewall to align with other Veeam products. Veeam Agent for Linux will now open ports 2500-3300. Solution These vulnerabilities were fixed starting with the following build: Veeam Backup & Replication 12.3.2.4465 If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam _____________________________________________________________________ Vulnerabilities Resolved in Veeam Backup & Replication 13.0.1.2067 KB ID: 4831 Product: Veeam Backup & Replication | 13 Published: 2026-03-12 Last Modified: 2026-03-12 All vulnerabilities documented in this article were resolved in Veeam Backup & Replication 13.0.1.2067. Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details All vulnerabilities disclosed in this article affect Veeam Backup & Replication 13.0.1.1071 and all earlier version 13 builds. CVE-2026-21669 A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. Severity: Critical CVSS v3.1 Score: 9.9 Affected Deployment Type: Windows-based Veeam Backup & Replication Source: Discovered during internal testing. CVE-2026-21670 A vulnerability allowing a low-privileged user to extract saved SSH credentials. Severity: High CVSS v3.1 Score: 7.7 Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Discovered during internal testing. CVE-2026-21671 A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication. Severity: Critical CVSS v3.1 Score: 9.1 Affected Deployment Type: Veeam Software Appliance Source: Discovered during internal testing. CVE-2026-21672 A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. Severity: High CVSS v3.1 Score: 8.8 Affected Deployment Type: Windows-based Veeam Backup & Replication Source: Reported through HackerOne. CVE-2026-21708 A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. Severity: Critical CVSS v3.1 Score: 9.9 Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Discovered during internal testing. Other Resolved Security-related Issues Veeam Agent for Linux — Updated the port range that the software will open in the machine's firewall to align with other Veeam products. Veeam Agent for Linux will now open ports 2500-3300. Solution These vulnerabilities were fixed starting with the following build: Veeam Backup & Replication 13.0.1.2067 If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================