Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution

Summary: Veeam released security updates for multiple critical vulnerabilities in its Backup & Replication software that could result in remote code execution, affecting version 12.3.2.4165 and all earlier version 12 builds, with fixes in 12.3.2.4465. CVE-2026-21672 and CVE-2026-21708 were also fixed in Backup & Replication 13.0.1.2067, along with two more critical flaws.
Why it matters: Veeam's own advisory warns that once a vulnerability and its patch are disclosed, attackers will likely reverse-engineer the patch to exploit unpatched deployments, and Veeam flaws have been repeatedly exploited by threat actors to carry out ransomware attacks in the past.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-21672 CVE-2026-21708
Related: ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026