What is the CVSS score of EUVD-2026-23438?

EUVD-2026-23438 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23438?

Yes, a patch is available for EUVD-2026-23438. Update the affected software to the latest version immediately.

Backup And Replication EUVD-2026-23438

| CVE-2026-21709 MEDIUM

Command Injection (CWE-77)

2026-04-17 hackerone

Command Injection Microsoft Backup And Replication Software Appliance

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 16:22 vuln.today

CVSS changed

Apr 20, 2026 - 16:22 NVD

6.7 (MEDIUM)

Patch released

Apr 20, 2026 - 16:16 nvd

Patch available

Apr 17, 2026 - 16:16 EUVD

EUVD ID Assigned

Apr 17, 2026 - 15:45 euvd

EUVD-2026-23438

Analysis Generated

Apr 17, 2026 - 15:45 vuln.today

CVE Published

Apr 17, 2026 - 15:32 nvd

MEDIUM 6.7

DescriptionCVE.org

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

AnalysisAI

Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows local administrators to load unsigned kernel drivers, potentially enabling persistent kernel-level compromise. The vulnerability requires high-level administrative privileges and is not actively exploited in the wild; however, EPSS scoring (0.01%) suggests this is a low-probability exploitation target despite the high CVSS score, indicating the attack scenario is constrained by strict privilege and configuration requirements.

Technical ContextAI

Windows Driver Signature Enforcement (DSE) is a security mechanism that prevents unsigned or improperly signed kernel drivers from loading, protecting the integrity of the kernel. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the vulnerability stems from insufficient validation or sanitization in a command execution context within Veeam's backup or appliance services. The affected CPE strings identify Veeam Backup and Replication and Veeam Software Appliance as the products; these are enterprise backup and disaster recovery platforms that often run with elevated system privileges. The vulnerability likely resides in a Veeam service or administrative interface that improperly constructs or validates commands passed to kernel-mode operations or driver loading mechanisms, allowing an authenticated administrative user to inject or manipulate parameters that bypass DSE validation.

RemediationAI

Upgrade Veeam Backup and Replication to version 12.3.2 or later, and upgrade Veeam Software Appliance to version 13.0.1 or later. These are vendor-released patches confirmed by Veeam support articles (KB4830 and KB4831). For environments unable to patch immediately, restrict administrative console access and local system access to trusted personnel only; disable remote administrative interfaces if not required for operations; and implement endpoint detection and response (EDR) monitoring on Veeam servers to detect attempts to load unsigned drivers. Note that no true workaround exists that maintains full functionality - all mitigations focus on access restriction. Organizations should test patches in non-production Veeam environments first due to the critical nature of backup systems, but the low real-world exploitation risk suggests standard change management timelines are acceptable rather than emergency patching.