What is the CVSS score of CVE-2026-21708?

CVE-2026-21708 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.5%.

Which versions of PostgreSQL are affected by CVE-2026-21708?

A critical vulnerability in Backup Viewer software allows attackers to execute arbitrary code with database administrator privileges, potentially leading to complete compromise of PostgreSQL…

How to fix or mitigate CVE-2026-21708?

Within 24 hours: Identify all systems running vulnerable Backup Viewer versions and isolate them from production networks if possible; disable remote access to Backup Viewer if not operationally required. Within 7 days: Implement network segmentation to restrict Backup Viewer access to authorized administrators only; enable comprehensive logging and monitoring for all Backup Viewer activities; conduct forensic review of backup viewer logs for signs of compromise. Within 30 days: Evaluate alternative backup solutions with stronger security postures; establish and enforce a vendor security advisory monitoring process; complete migration away from vulnerable versions if available alternatives exist.

PostgreSQL CVE-2026-21708

CRITICAL

SQL Injection (CWE-89)

2026-03-12 support@hackerone.com

PostgreSQL RCE SQLi

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

CRITICAL 9.9

DescriptionCVE.org

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

AnalysisAI

Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.

Technical ContextAI

A user assigned the Backup Viewer role (intended to be read-only) can exploit access control weaknesses to execute arbitrary code as the postgres database user on the Veeam server (CWE-284 implied). This breaks the principle of least privilege and the scope change reflects execution outside the Veeam application.