VIR Vulnerability Intelligence Relay

CVE-2026-21669

critical
Published 2026-03-12 · Modified 2026-05-10
CVSS v3
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v2
—
VIR risk
9.9

Description

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Predictions

Exploit likelihood
98%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: support@hackerone.com — https://www.veeam.com/kb4831

Application impact
VendorProductVersionsFixed
veeamveeam_backup_\&_replication{"startIncluding":"13.0.0.496","endExcluding":"13.0.1.2067"}13.0.1.2067

References

CWEs

CWE-94 CWE-693

Verify integrity in audit chain (admin only). AS-IS.