# CVE-2026-21668: A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

Source: https://junglewise.ai/threats/cve-2026-21668-a-vulnerability-allowing-an-authenticated-domain-user-to-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-21668 · Severity: high · CVSS 8.8 · Published 2026-03-12

Veeam Backup & Replication is a platform used by organizations to manage and store backups of their critical data. A security vulnerability in this software allows a user with basic network credentials to bypass security controls and modify or delete files within the backup storage area. This could lead to the loss of backup integrity, potentially preventing a company from recovering data after a ransomware attack or system failure.

Technologies: [Veeam Backup \](https://junglewise.ai/threats/technologies/veeam-backup). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-21668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21668 being exploited in the wild.

**How severe is CVE-2026-21668?** High severity, with a CVSS score of 8.8, published 12 March 2026.

**Which products and versions are affected?** Veeam Veeam Backup & Replication 12.0.0.1402 up to 12.3.2.4165, 13.0.0.496 up to 13.0.1.1071.

**Is there a fix for CVE-2026-21668?** A patch was published on 2026-03-12: Fixed in version 12.3.2.4465 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21668 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-21668?** Check whether you run Veeam Backup \. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) and protection mechanism failure (CWE-693) exists in Veeam Backup & Replication. An attacker with low-privileged domain user credentials can exploit this flaw over the network without user interaction. Successful exploitation allows the attacker to bypass existing security restrictions to read, modify, or delete arbitrary files stored on the Backup Repository. This poses a significant risk to backup integrity and availability. The issue is resolved in Veeam Backup & Replication version 12.3.2.4465.

## Affected products

- Veeam Veeam Backup & Replication 12.0.0.1402 up to 12.3.2.4165, 13.0.0.496 up to 13.0.1.1071

## Timeline

- 2026-03-12: disclosed
- 2026-03-12: advisory
- 2026-03-12: patched: Fixed in version 12.3.2.4465

## References

- [https://www.veeam.com/kb4830](https://www.veeam.com/kb4830)

## Related threats

- [Veeam Backup & Replication SQL injection RCE as postgres user](https://junglewise.ai/threats/cve-2026-21708-veeam-backup-replication-sql-injection-rce-as-postgres-user)
- [A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution…](https://junglewise.ai/threats/cve-2026-21671-a-vulnerability-allowing-an-authenticated-user-with-the-backup)
- [A vulnerability allowing a low-privileged user to extract saved SSH credentials.](https://junglewise.ai/threats/cve-2026-21670-a-vulnerability-allowing-a-low-privileged-user-to-extract-saved)
- [A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.](https://junglewise.ai/threats/cve-2026-21669-a-vulnerability-allowing-an-authenticated-domain-user-to-perform)
- [This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a…](https://junglewise.ai/threats/cve-2025-59470-this-vulnerability-allows-a-backup-operator-to-perform-remote)