CVE-2026-21670: A vulnerability allowing a low-privileged user to extract saved SSH credentials.

CVE-2026-21670 · Severity: high · CVSS 7.7 · Published 2026-03-12

A vulnerability in Veeam Backup & Replication allows a user with low-level access to the system to extract saved SSH credentials. This software is used by organizations to manage and protect their data backups. If exploited, an attacker could gain unauthorized access to other servers and infrastructure connected to the backup environment, potentially leading to broader data breaches or system compromise.

Technologies: Veeam Backup \. Vendors: Veeam.

Quick answers

Is CVE-2026-21670 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-21670 being exploited in the wild.
How severe is CVE-2026-21670?
High severity, with a CVSS score of 7.7, published 12 March 2026.
Which products and versions are affected?
Veeam Veeam Backup & Replication 13.0.0.496 through 13.0.1.1071; Veeam Veeam Software Appliance 13.x versions prior to 13.0.1.2067.
Is there a fix for CVE-2026-21670?
A patch was published on 2026-03-12: Fixed in build 13.0.1.2067 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21670 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21670?
Check whether you run Veeam Backup \. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A credential disclosure vulnerability (CWE-522) exists in Veeam Backup & Replication and the Veeam Software Appliance. The flaw allows an authenticated user with low privileges to extract saved SSH credentials from the system. The vulnerability stems from insufficiently protected credentials within the application's management of stored secrets. An attacker with network access and valid low-privileged credentials can exploit this to gain high-impact confidentiality access (CVSS C:H) and potentially pivot to other systems. The issue is resolved in Veeam Backup & Replication version 13.0.1.2067.

Affected products

  • Veeam Veeam Backup & Replication 13.0.0.496 through 13.0.1.1071
  • Veeam Veeam Software Appliance 13.x versions prior to 13.0.1.2067

Timeline

  • 2026-03-12: disclosed
  • 2026-03-12: advisory
  • 2026-03-12: patched: Fixed in build 13.0.1.2067

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.