What is the CVSS score of CVE-2026-21708?

CVE-2026-21708 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-21708?

Within 24 hours: Identify all systems running vulnerable Backup Viewer versions and isolate them from production networks if possible; disable remote access to Backup Viewer if not operationally required. Within 7 days: Implement network segmentation to restrict Backup Viewer access to authorized administrators only; enable comprehensive logging and monitoring for all Backup Viewer activities; conduct forensic review of backup viewer logs for signs of compromise. Within 30 days: Evaluate alternative backup solutions with stronger security postures; establish and enforce a vendor security advisory monitoring process; complete migration away from vulnerable versions if available alternatives exist.

PostgreSQL CVE-2026-21708

CRITICAL

SQL Injection (CWE-89)

2026-03-12 support@hackerone.com

RCE SQLi PostgreSQL Veeam Backup Replication Veeam

9.9

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as privileged user
Exploit

Upload malicious backup file
Execution

Trigger backup restoration process
Impact

Execute arbitrary code as postgres user

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authenticated access to Backup Viewer with privileges to upload or restore backup files. Requires PR:L (low privilege user account) on the backup management system.
Impact	CVSS 9.9 (Critical). Low privileges (Viewer role), network vector, low complexity, scope change. The postgres user often has broad system access. EPSS 0.54%.
Exploit ScenarioDerived	An attacker gains access to a Viewer account (e.g., through social engineering of a junior operator), then escalates to code execution as postgres. From there, they can access all backup metadata and potentially the backup data itself.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 19:57 CVSS 9.9

Veeam Backup Viewer role can escalate to RCE as the postgres user, breaking the read-only access boundary.

RemediationAI

Patch Veeam immediately. Audit all Viewer role assignments. Monitor postgres process execution for anomalous commands.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

A user assigned the Backup Viewer role (intended to be read-only) can exploit access control weaknesses to execute arbitrary code as the postgres database user on the Veeam server (CWE-284 implied). This breaks the principle of least privilege and the scope change reflects execution outside the Veeam application.

Know when PostgreSQL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

DescriptionCVE.org

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Executive ViewAI

Why It Matters

A critical vulnerability in Backup Viewer software allows attackers to execute arbitrary code with database administrator privileges, potentially leading to complete compromise of PostgreSQL databases and sensitive data theft or destruction. This poses an immediate threat to any organization using this backup tool and requires urgent remediation to prevent active exploitation.

Business Impact: Severe

Compensating Controls

Restrict Backup Viewer network access to trusted IP addresses via firewall rules; require multi-factor authentication for Backup Viewer access; implement WAF rules blocking suspicious Backup Viewer input patterns if web-based; disable Backup Viewer service entirely if operationally feasible and use alternative backup restoration methods; deploy host-based intrusion detection on systems running Backup Viewer; run Backup Viewer process with least-privilege account isolation; maintain real-time file integrity monitoring on backup storage locations.

Threat Intelligence Overview

EPSS Score

0.5%

Top 33% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.