CVE-2026-21671

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

Score

CVSS 3.1 9.1 Critical

Status

Modified - support@hackerone.com

Published

2026-03-12

Last modified

2026-05-10

Weaknesses

CWE-693, CWE-94

Affected products

• Software Appliance (Veeam)
• Veeam Backup & Replication (Veeam)

References

• https://www.veeam.com/kb4831