CVE-2026-21669
Published: 12 March 2026
Summary
CVE-2026-21669 is a critical-severity Code Injection (CWE-94) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 36.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-21669 by requiring timely remediation of the code injection flaw through patching as specified in the vendor advisory.
Prevents code injection (CWE-94) exploitation by enforcing validation of all information inputs to the Backup Server, blocking arbitrary code execution.
Limits the impact of successful RCE by ensuring low-privilege domain users and processes have only necessary access rights on the Backup Server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Code injection vulnerability enables authenticated remote code execution on Backup Server, directly facilitating T1210 (Exploitation of Remote Services) for initial access/escalation and T1068 (Exploitation for Privilege Escalation) due to low-priv to full system control.
NVD Description
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Deeper analysisAI
CVE-2026-21669 is a code injection vulnerability (CWE-94) that enables an authenticated domain user to execute arbitrary code remotely on the affected Backup Server. Published on 2026-03-12, it carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and potential for high-impact privilege escalation across security scopes.
An attacker requires only valid low-privilege domain user credentials to exploit the vulnerability over the network without user interaction. Successful exploitation grants remote code execution on the Backup Server, allowing full control over the system, including potential data exfiltration, modification, or disruption.
Mitigation details are provided in the vendor advisory at https://www.veeam.com/kb4831.
Details
- CWE(s)