Is CVE-2026-21708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21708 being exploited in the wild.

How severe is CVE-2026-21708?

Critical severity, with a CVSS score of 9.9, published 12 March 2026.

Which products and versions are affected?

Veeam Backup & Replication 12.0.0.1402 up to (excluding) 12.3.2.4465; 13.0.1.1071 and all earlier version 13 builds.

Is there a fix for CVE-2026-21708?

A patch was published on 2026-03-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21708 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-21708?

Check whether you run Veeam Backup & Replication or Veeam Backup \ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21708: Veeam Backup & Replication SQL injection RCE as postgres user

CVE-2026-21708 · Severity: critical · CVSS 9.9 · Published 2026-03-12

Veeam Backup & Replication is a data protection solution used to back up, restore, and replicate critical business data. A security vulnerability allows a user with 'Backup Viewer' permissions to execute unauthorized commands on the underlying database server. This could lead to a complete takeover of the backup infrastructure, potentially allowing an attacker to delete backups or steal sensitive corporate data.

Technologies: Veeam Backup & Replication, Veeam Backup \. Vendors: Veeam.

Quick answers

Is CVE-2026-21708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21708 being exploited in the wild.
How severe is CVE-2026-21708?: Critical severity, with a CVSS score of 9.9, published 12 March 2026.
Which products and versions are affected?: Veeam Backup & Replication 12.0.0.1402 up to (excluding) 12.3.2.4465; 13.0.1.1071 and all earlier version 13 builds.
Is there a fix for CVE-2026-21708?: A patch was published on 2026-03-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21708 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21708?: Check whether you run Veeam Backup & Replication or Veeam Backup \ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in Veeam Backup & Replication that allows an authenticated user with the 'Backup Viewer' role to achieve remote code execution. The flaw enables the attacker to execute arbitrary commands with the privileges of the 'postgres' service account. This vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue is reachable over the network without user interaction, provided the attacker has valid low-privileged credentials. The vulnerability is resolved in versions 12.3.2.4465 and 13.0.1.2067.

Affected products

Veeam Veeam Backup & Replication 12.0.0.1402 up to (excluding) 12.3.2.4465; 13.0.1.1071 and all earlier version 13 builds

Timeline

2026-03-12: disclosed
2026-03-12: advisory
2026-03-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.