CVE-2026-21672: 
Veeam Backup & Replication vulnerability analysis and mitigation

CVE-2026-21672 is a local privilege escalation vulnerability affecting Windows-based Veeam Backup & Replication servers. It was published on March 12, 2026, and is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). Affected versions include Veeam Backup & Replication prior to 12.3.2 and 13.0.1. It carries a CVSS v3.1 base score of 8.8 (High) (Feedly, ENISA EUVD).

The root cause is classified as CWE-538 — insertion of sensitive information into an externally-accessible file or directory — which enables a low-privileged local user to escalate their privileges on the affected Windows host. The vulnerability has a local attack vector, requires low privileges, no user interaction, and has a changed scope, meaning the impact extends beyond the vulnerable component itself. The CVE was assigned via HackerOne, suggesting it was responsibly disclosed through a bug bounty program. No public proof-of-concept or detailed technical write-up has been identified at this time (Feedly, ENISA EUVD).

Successful exploitation allows a low-privileged local attacker to gain high-level (likely SYSTEM-level) access on the Veeam Backup & Replication server, resulting in full confidentiality, integrity, and availability compromise. An attacker could access sensitive backup data including credentials and configurations stored by Veeam, modify or delete backup jobs and recovery points, and disrupt backup and replication services. Because Veeam servers typically hold credentials for a wide range of infrastructure targets, privilege escalation on such a system significantly increases the risk of lateral movement across the broader environment (Feedly, Arctic Wolf).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation for CVE-2026-21672 (Feedly). The EPSS score is approximately 0.051%, indicating a low current probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the broader March 2026 Veeam advisory batch — which included seven critical flaws — attracted significant attention from ransomware groups and threat actors historically known to target Veeam infrastructure (Bulwark Black, The Hacker News).

Veeam has released patched versions addressing this vulnerability: Veeam Backup & Replication 12.3.2 and 13.0.1. Organizations should upgrade to these versions immediately, prioritizing internet-exposed or widely-accessible Veeam servers. As interim mitigations, administrators should enforce the principle of least privilege for all local accounts on Veeam servers, restrict local logon access to only authorized personnel, and monitor for unusual privilege escalation activity. Veeam's official knowledge base articles KB4830 and KB4831 provide additional guidance (Veeam KB4830, Veeam KB4831, Arctic Wolf).

The March 2026 Veeam advisory batch — of which CVE-2026-21672 is a part — received broad coverage from security media and researchers. The Hacker News, CSO Online, TechRadar, and Heise all reported on the urgency of patching, with several outlets noting that ransomware groups have historically targeted Veeam vulnerabilities (The Hacker News, CSO Online, Heise). Arctic Wolf and SmarterMSP published threat advisories urging immediate patching, and Bulwark Black specifically highlighted ransomware group interest in the broader vulnerability set (Bulwark Black, SmarterMSP). Ireland's NCSC also issued an advisory referencing the related CVE cluster (NCSC Ireland).