Highest advisory severityCritical 1 vendor · 3 advisories

CVE-2026-21671

CVE-2026-21671 is covered by the Veeam CVE-2026-21671 security bulletin. Not in the CISA KEV catalog. Critical advisory severity. 3 advisories from Veeam.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Veeam publishes the next one.

VulniPulse checks Veeam's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-21671 key facts

CISA KEV: Not listed (catalog checked Oct 30, 2026)
Highest advisory severity: Critical
Vendor advisories: 3 from Veeam
VulniPulse record: Published Jul 12, 2026 · Updated Oct 29, 2026

Is CVE-2026-21671 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-21671 is not in the CISA KEV catalog (checked Oct 30, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-21671?

This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.

Vendor advisory comparison

Veeam

3 advisories

Advisory severityCritical9.9
Critical [CVE-2026-21669 +5] Veeam Backup & Replication: vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high…
CVE-2026-21671Source published Mar 12, 2026Source updated Jun 17, 2026
This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
Related products — impact not confirmed
Veeam Backup & Replication
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
13.0.1.2067
Mitigation guidance
No mitigation guidance extracted; consult the source.
Full advisory and evidence Open source bulletin
Advisory severityUnrated
Advisory [CVE-2026-105477 +13] Release Information for Veeam Backup & Replication 13 and Updates
KB4738Source published Oct 27, 2026
This bulletin covers 14 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Release Information for Veeam Backup & Replication 13 and Updates KB ID: 4738 Product: Published: 2025-09-03 Last Modified: 2026-10-29 13.1.2.57 This cumulative patch addresses issues, reports, and feedback received from customers, partners, service providers, and the community. The top-reported issues are listed below. Want to get rid of manual patching? Upgrade to the latest version and receive all future patches automatically through Veeam Updater. This patch becomes available through Veeam Updater as soon as the Veeam update repository is updated. It is then rolled out to Veeam Software Appliance 13.1 installations and, gradually, to all Windows-based Veeam Backup & Replication 13.1 deployments. To upgrade right away, download the 13.1 installation media now from My Account. Security…
Related products — impact not confirmed
No product details extracted. Check the source bulletin.
Source-reported affected versions
13.1.2.11
13.1.2.4
13.1.2.2270
13.1.1.18
Source-reported fixed versions
Veeam Software Appliance 13.1
Veeam Agent for Microsoft Windows 13.1.2.812
Veeam Agent for Linux 13.1.2.11
Veeam Agent for Mac 13.1.2.4
4 more entries in the full advisory.
Mitigation guidance
Release Information for Veeam Backup & Replication 13 and Updates KB ID: 4738 Product: Veeam Backup & Replication | 13 | 13.1 Published: 2025-09-03 Last Modified: 2026-10-29 Release Information 13.1.2.57 2026-10-27 This cumulative patch addresses issues, reports, and feedback received from customers, partners, service providers, and the community.
Upgrade to the latest version and receive all future patches automatically through Veeam Updater.
This patch becomes available through Veeam Updater as soon as the Veeam update repository is updated.
To upgrade right away, download the 13.1 installation media now from My Account.
4 more entries in the full advisory.
Full advisory and evidence Open source bulletin
Advisory severityUnrated
Advisory [CVE-2021-35971 +51] List of Security Fixes and Improvements in Veeam Backup & Replication
KB3103Source published Aug 25, 2026
This bulletin covers 52 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
List of Security Fixes and Improvements in Veeam Backup & Replication KB ID: 3103 Product: Published: 2020-03-02 Last Modified: 2026-10-20 Purpose 13.1.2.57 - @angular/core / common / compiler upgraded to version 21.2.20 - System. Security.Cryptography. Xml upgraded to version 10.0.10 - Microsoft. AspNetCore. Authentication.Negotiate upgraded to version 10.0.11 - decode-uri-component upgraded to version 0.5.0 - dompurify upgraded to version 3.4.15 - postcss upgraded to version 8.5.28 - OpenSSL upgraded to version 3.5.8 13.1.0.411 - CoreWCF.Primitives upgraded to version 1.8.1 - MailKit upgraded to version 4.17.0 - MimeKit upgraded to version 4.17.0 - OpenTelemetry upgraded to version 1.15.3 - SQLite upgraded to version 3.53.2 - curl upgraded to version 8.21.0 - zlib upgraded to version…
Affected products in this advisory
Backup and Replication
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
List of Security Fixes and Improvements in Veeam Backup & Replication KB ID: 3103 Product: Veeam Backup & Replication | 10 | 11 | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 | 13 | 13.1 Published: 2020-03-02 Last Modified: 2026-10-20 Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup & Replication.
The goal of this article is to provide our customers' security and compliance teams with detailed information on security improvements between releases, in order to help them make an informed decision on whether it is critical to upgrade from their current Veeam Backup & Replication version to a latter one.
Added possibility to limit the number of logon sessions per user and to log off users after an inactivity period SMTP certificates validation was added for email notifications Network communication between CDP components is encrypted with TLS Disabled insecure TLS protocols in communication with VMware infrastructure zlib has been updated to version 1.2.13 OpenSSL version has been updated to 1.0.2ze Putty has been updated to version 0.76 11.0.1.1261 P20240304 VMware Virtual Disk Development Kit (VDDK) was updated to 7.0.3.4.
Full advisory and evidence Open source bulletin

All Veeam advisories

Follow CVE-2026-21671 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Veeam CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features