CVE-2026-21667 Missing authorization in Backup and Replication
An authenticated domain user can execute arbitrary code on the Veeam Backup Server due to improper access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21667?
CVE-2026-21667 is a critical missing authorization vulnerability in Veeam Backup and Replication, published on 12 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Weakness: CWE-284
Which versions are affected by CVE-2026-21667?
It affects 1 product.
Products include Veeam Veeam Backup \& Replication.
How do I fix CVE-2026-21667?
No fix has been published for CVE-2026-21667 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-21667 being exploited?
There is no known exploitation of CVE-2026-21667 in the wild and no public exploit code.
Other vulnerabilities in Veeam Backup and Replication
- CVE-2024-40711 Veeam Backup and Replication Deserialization
- CVE-2022-26501 Veeam Backup & Replication Remote Code Execution
- CVE-2022-26500 Veeam Backup & Replication Remote Code Execution
- CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function
- CVE-2026-21666 Missing authorization in Backup and Replication
Sources
Also known as GHSA-hccx-359g-p95f.