CVE-2026-21708: 
Veeam Backup & Replication vulnerability analysis and mitigation

CVE-2026-21708 is a critical SQL injection vulnerability in Veeam Backup & Replication that enables a user with the Backup Viewer role to perform remote code execution (RCE) as the postgres database user. It affects versions 12.0.0.1402 through 12.3.2.4465 (exclusive) of Veeam Backup & Replication. The vulnerability was published on March 12, 2026, and is classified under CWE-89 (SQL Injection). It carries a CVSS v3.1 base score of 9.9 (Critical) per NVD, and ENISA's EUVD rates it 10.0 (Critical) (Veeam KB4830, Veeam KB4831, ENISA EUVD).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), allowing an authenticated Backup Viewer to inject malicious SQL that is executed by the PostgreSQL database backend. Because the vulnerability achieves a scope change (S:C in CVSS), the injected commands can escape the database context and execute operating system commands as the postgres user. Exploitation requires only low privileges (the Backup Viewer role) and no user interaction, and is reachable over the network with low attack complexity. Attack patterns associated with this vulnerability include command-line execution through SQL injection (CAPEC-108) and expanding OS control from the database (CAPEC-470) (Veeam KB4830, BleepingComputer).

Successful exploitation grants an attacker arbitrary code execution as the postgres operating system user on the Veeam Backup & Replication server, providing full access to the backup database and potentially the entire backup infrastructure. The high confidentiality and integrity impacts mean an attacker can read, modify, or delete backup data and credentials stored in the database, while the changed scope allows lateral movement beyond the database process itself. Given that Veeam servers typically hold credentials and backup data for an organization's entire IT estate, compromise can facilitate ransomware deployment, data exfiltration, or destruction of backup copies (Veeam KB4830, BleepingComputer, Arctic Wolf).

No public proof-of-concept exploit has been confirmed as of the time of reporting; however, the vulnerability has been weaponized in the wild. The ransomware families Fog and Akira, as well as threat actor Storm-1567, have been identified as exploiting this vulnerability against backup infrastructure (CyberSecBrief). The EPSS score is approximately 0.445%, reflecting moderate automated exploitation probability. Patches were released on March 12, 2026, and Qualys detection signatures (IDs 386794 and 386795) are available (Veeam KB4830, Veeam KB4831).

1. Reconnaissance: Identify internet-facing or internally accessible Veeam Backup & Replication servers running versions 12.0.0.1402 through 12.3.2.4465 using network scanning tools (e.g., Shodan, Nmap) or internal asset inventories.
2. Obtain Backup Viewer credentials: Acquire credentials for an account with the Backup Viewer role — this may be achieved through phishing, credential stuffing, or reuse of previously compromised credentials, as only low-privilege access is required.
3. Authenticate to the Veeam server: Log in to the Veeam Backup & Replication management interface or API endpoint using the Backup Viewer account.
4. Inject malicious SQL payload: Craft a request to a vulnerable API or management endpoint that passes unsanitized input into a SQL query, embedding a payload that leverages PostgreSQL's COPY TO/FROM PROGRAM or similar OS command execution feature (e.g., '; COPY (SELECT '') TO PROGRAM 'malicious_command'; --).
5. Achieve RCE as postgres: The injected SQL executes an OS-level command as the postgres user, enabling reverse shell establishment, credential harvesting from the Veeam database, or deployment of ransomware payloads such as Fog or Akira.
6. Lateral movement: Use harvested credentials or access to backup data to pivot to other systems within the organization's infrastructure (BleepingComputer, Arctic Wolf).

• Network: Unexpected outbound connections from the Veeam Backup & Replication server to unknown external IP addresses; unusual traffic on PostgreSQL port (5432) from non-standard sources; reverse shell connections originating from the Veeam server process.
• Logs: Veeam server logs showing authenticated Backup Viewer accounts making unusual or high-frequency API/management requests; PostgreSQL logs (postgresql.log) containing COPY TO PROGRAM or similar OS execution statements; Windows Event Logs or Linux audit logs recording unexpected process creation by the postgres user.
• File System: New or modified files in the Veeam installation directory or PostgreSQL data directory created by the postgres user; presence of ransomware binaries (associated with Fog or Akira) or web shells on the backup server; unexpected scheduled tasks or cron jobs added under the postgres account.
• Process: Unusual child processes spawned by the PostgreSQL process (e.g., cmd.exe, powershell.exe, bash, curl, wget); execution of network tools (e.g., nc, ncat) from the postgres user context (BleepingComputer, Arctic Wolf).

Veeam has released patches addressing this vulnerability: upgrade Veeam Backup & Replication to version 12.3.2.4465 or later (v12 branch) or to 13.0.1 or later (v13 branch) (Veeam KB4830, Veeam KB4831). As an interim measure, restrict assignment of the Backup Viewer role to the minimum number of trusted users and enforce strong, unique credentials for all Veeam accounts. Additionally, limit network access to the Veeam management interface to authorized hosts only, and monitor for suspicious activity from the postgres user account (Veeam KB4830, BleepingComputer).

Veeam issued urgent advisories (KB4830 and KB4831) urging immediate patching, describing the flaws as critical RCE vulnerabilities affecting backup servers (Veeam KB4830). BleepingComputer, The Hacker News, CSO Online, and TechRadar all covered the disclosure prominently, emphasizing the ransomware group interest in Veeam vulnerabilities (BleepingComputer, The Hacker News). Arctic Wolf and SocRadar published detailed threat advisories noting the involvement of Fog, Akira, and Storm-1567 (Arctic Wolf). Security researchers and the community broadly characterized the vulnerability as high-priority given Veeam's widespread use in enterprise backup environments and the history of ransomware actors targeting Veeam flaws (Bulwark Black).