Critical RCE in Veeam Backup & Replication (CVE‑2026‑21666, CVE‑2026‑21667) Threatens Enterprise Data Protection
What It Is – Veeam released emergency patches for seven critical flaws in its Backup & Replication platform. Two of the most severe (CVE‑2026‑21666, CVE‑2026‑21667) grant an authenticated domain user the ability to execute arbitrary code on the backup server, potentially compromising all protected workloads.
Exploitability – The vulnerabilities are publicly disclosed with a CVSS 9.9 score for CVE‑2026‑21666. No public exploit code has been observed yet, but the severity and required authentication make rapid weaponisation plausible.
Affected Products – Veeam Backup & Replication (all supported versions prior to the March 2026 security update).
TPRM Impact – Backup infrastructure is a core third‑party service for most enterprises. A successful RCE could expose backed‑up data, disrupt recovery processes, and cascade into ransomware or data‑exfiltration attacks across supply‑chain partners.
Recommended Actions –
- Deploy Veeam’s March 2026 security updates across every Backup & Replication server within 24 hours.
- Enforce least‑privilege for domain accounts; restrict authenticated access to backup services.
- Conduct post‑patch validation and integrity checks of backup repositories.
- Enable comprehensive logging and monitor for anomalous process creation on backup hosts.
- Review third‑party contracts to confirm vendors have applied the patches and updated their security attestations.
Source: The Hacker News