What is the CVSS score of CVE-2026-21671?

CVE-2026-21671 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Veeam Backup Replication are affected by CVE-2026-21671?

A critical vulnerability in Veeam Backup & Replication allows authenticated Backup Administrators to execute arbitrary code on HA-deployed systems, potentially compromising backup infrastructure and…

How to fix or mitigate CVE-2026-21671?

Within 24 hours: Inventory all Veeam Backup & Replication HA deployments and audit Backup Administrator role assignments, revoking unnecessary access. Within 7 days: Implement network segmentation to restrict backup infrastructure access and enable enhanced logging on backup servers. Within 30 days: Contact Veeam for patch availability timeline; evaluate air-gapping critical backup systems or migrating to non-HA deployments if patch delay extends beyond 30 days.

Veeam Backup Replication CVE-2026-21671

CRITICAL

Code Injection (CWE-94)

2026-03-12 support@hackerone.com

RCE Code Injection Veeam Backup Replication Veeam

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 15:16 nvd

CRITICAL 9.1

DescriptionCVE.org

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

AnalysisAI

Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring admin-level access, the scope change to the HA infrastructure makes this critical for organizations running Veeam in HA mode.

Technical ContextAI

In high-availability configurations, a user with the Backup Administrator role can exploit insufficient access controls to execute code beyond the Veeam application boundary (S:C). The HA deployment model may expand the blast radius to multiple Veeam nodes.

RemediationAI

Apply Veeam patches. Implement least-privilege for Backup Administrator roles. Monitor admin actions in HA environments. Segment HA communication channels.