What is the CVSS score of CVE-2026-21668?

CVE-2026-21668 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Veeam Backup Replication are affected by CVE-2026-21668?

An authenticated domain user can bypass file restrictions and manipulate backup data without authorization, creating significant risk to data integrity and recovery capabilities.

How to fix or mitigate CVE-2026-21668?

Within 24 hours: Identify all backup repository instances and document current access controls; audit recent backup modification logs for suspicious activity. Within 7 days: Implement network segmentation to restrict backup repository access to authorized administrators only; enable enhanced logging and alerting on all file operations. Within 30 days: Evaluate alternative backup solutions; conduct full forensic review of backup integrity; develop and test incident response procedures for backup compromise scenarios.

Veeam Backup Replication CVE-2026-21668

HIGH

Missing Authorization (CWE-862)

2026-03-12 support@hackerone.com

Authentication Bypass Veeam Backup Replication Veeam

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 15:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

AnalysisAI

Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete arbitrary files due to insufficient authorization controls. This high-severity flaw affects users with valid domain credentials and requires no user interaction to exploit. No patch is currently available for this vulnerability.