CVE-2026-21671

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution RCE in high availability HA deployments of Veeam Backup & Replication...

CVE-2026-21668

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository...

CVE-2026-21666

CVE-2026-21666 is a vulnerability affecting Veeam Backup & Replication where an authenticated domain user can perform remote code execution on the Backup Server. Public data across multiple feeds confirms the issue stems from access-control weaknesses enabling code execution with high impact on b...

CVE-2026-21671

Veeam Backup & Replication in high availability deployments is affected by CVE-2026-21671. An authenticated user with the Backup Administrator role can perform remote code execution. CVSS v3.1 base score is 9.1 (CRITICAL) , with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H; impact is HIGH ...

CVE-2026-21669

CVE-2026-21669: An authenticated domain user can perform remote code execution on the Backup Server. The entry provides a high-severity CVSSv3.1 base score (9.9, CRITICAL) with Network attack vector, Low complexity, Privileges Required: Low, No user interaction, and all impact metrics (Confidenti...

CVE-2026-21668

Technical details about CVE-2026-21668 are not provided in the supplied documents. Monitor for updates from Veeam (KB4830) and related advisories for affected products, impact, and remediation.

Vulnerabilities fixed in Veeam Backup & Replication

Veeam has fixed vulnerabilities in Veeam Backup & Replication. The vulnerabilities allow an authenticated domain user to remotely execute code on the backup server, which can lead to unauthorized control of backup operations. This issue is present in the backup server environment and can be...

EUVD-2026-11585

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384 Authenticated RCE via unsanitized compression_algorithm

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384

CVE-2026-28384 : Canonical LXD contains an improper sanitization of the compression_algorithm parameter, allowing an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. Affected: LXD releases 4.12–6.6. Mitigatio...

CVE-2026-28384 Authenticated RCE via unsanitized compression_algorithm

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384 Authenticated RCE via unsanitized compression_algorithm

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

CVE-2026-28384

An improper sanitization of the compressionalgorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the sn...

PT-2026-24952

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication affected versions not specified Description The software contains a flaw that allows an authenticated domain user to perform remote code execution RCE on the Backup Server. This could lead to compromise of backup...

Veeam Backup And Replication 安全漏洞

Veeam Backup and Replication is a backup and replication software developed by the American company Veeam. Veeam Backup and Replication has a security vulnerability that stems from allowing authenticated domain users to execute remote code execution...

Veeam Backup And Recovery 安全漏洞

Veeam Backup and Recovery is a data backup, recovery, and replication software developed by the American company Veeam. Veeam Backup and Recovery has a security vulnerability that stems from allowing authenticated users with the role of backup administrators to execute remote code execution in...

PT-2026-24953

CVE: CVE-2026-21667 PT-Identifier: PT-2026-24953 Vendor: Veeam Product: Backup and Replication CVSS: 10.0 Credits: n/a Description: A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server. References: • https://t.co/jp2KMmocwj •...

Veeam Backup And Replication 安全漏洞

Veeam Backup and Replication is a backup and replication software developed by the American company Veeam. Veeam Backup and Replication has a security vulnerability that allows authenticated domain users to bypass restrictions and manipulate any file within the backup repository...