What is the CVSS score of CVE-2026-21708?

CVE-2026-21708 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.5%.

Which versions of PostgreSQL are affected by CVE-2026-21708?

A critical vulnerability in Backup Viewer software allows attackers to execute arbitrary code with database administrator privileges, potentially leading to complete compromise of PostgreSQL…

How to fix or mitigate CVE-2026-21708?

Within 24 hours: Identify all systems running vulnerable Backup Viewer versions and isolate them from production networks if possible; disable remote access to Backup Viewer if not operationally required. Within 7 days: Implement network segmentation to restrict Backup Viewer access to authorized administrators only; enable comprehensive logging and monitoring for all Backup Viewer activities; conduct forensic review of backup viewer logs for signs of compromise. Within 30 days: Evaluate alternative backup solutions with stronger security postures; establish and enforce a vendor security advisory monitoring process; complete migration away from vulnerable versions if available alternatives exist.

PostgreSQL CVE-2026-21708

CRITICAL

SQL Injection (CWE-89)

2026-03-12 support@hackerone.com

RCE SQLi PostgreSQL Veeam Backup Replication Veeam

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

CRITICAL 9.9

DescriptionCVE.org

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

AnalysisAI

Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.

Technical ContextAI

A user assigned the Backup Viewer role (intended to be read-only) can exploit access control weaknesses to execute arbitrary code as the postgres database user on the Veeam server (CWE-284 implied). This breaks the principle of least privilege and the scope change reflects execution outside the Veeam application.