What is the CVSS score of CVE-2026-21672?

CVE-2026-21672 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-21672?

A high-severity local privilege escalation vulnerability (CVE-2026-21672) affects Windows-based Veeam Backup & Replication servers, allowing authenticated users to gain system-level access.

How to fix or mitigate CVE-2026-21672?

Within 24 hours: Inventory all Windows-based Veeam Backup & Replication servers and restrict local administrative access to essential personnel only. Within 7 days: Implement enhanced monitoring and logging on affected Veeam servers, review access logs for suspicious privilege escalation attempts, and apply compensating controls listed below. Within 30 days: Prepare for immediate patching upon vendor release and conduct a full security audit of Veeam infrastructure.

Microsoft CVE-2026-21672

HIGH

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-03-12 support@hackerone.com

Privilege Escalation Microsoft

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

AnalysisAI

Local privilege escalation in Veeam Backup & Replication on Windows enables authenticated users to gain system-level access without user interaction. An attacker with local account credentials can exploit this vulnerability to achieve complete control over the backup infrastructure, including reading, modifying, or deleting backups. No patch is currently available for this high-severity issue affecting backup administrators and organizations relying on Veeam for data protection.