Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 1 vendor · 4 advisories

CVE-2026-21708

CVE-2026-21708 is covered by the Veeam CVE-2026-21672 security bulletin. Not in the CISA KEV catalog. Critical advisory severity. 4 advisories from Veeam.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Veeam publishes the next one.

VulniPulse checks Veeam's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-21708 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Critical
Vendor advisories
4 from Veeam
VulniPulse record
Published · Updated

Is CVE-2026-21708 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-21708 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-21708?

This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.

Vendor advisory comparison

Veeam

4 advisories
  • Advisory severityCritical9.9

    Critical [CVE-2026-21666 +5] Veeam Backup & Replication: vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

    CVE-2026-21672Source published Source updated

    This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

    Related products — impact not confirmed
    • Veeam Backup & Replication
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • 12.3.2.4465
    • 12.3.2
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityCritical9.9

    Critical [CVE-2026-21669 +5] Veeam Backup & Replication: vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high…

    CVE-2026-21671Source published Source updated

    This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

    Related products — impact not confirmed
    • Veeam Backup & Replication
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • 13.0.1.2067
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2026-105477 +13] Release Information for Veeam Backup & Replication 13 and Updates

    KB4738Source published

    This bulletin covers 14 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Release Information for Veeam Backup & Replication 13 and Updates KB ID: 4738 Product: Published: 2025-09-03 Last Modified: 2026-10-29 13.1.2.57 This cumulative patch addresses issues, reports, and feedback received from customers, partners, service providers, and the community. The top-reported issues are listed below. Want to get rid of manual patching? Upgrade to the latest version and receive all future patches automatically through Veeam Updater. This patch becomes available through Veeam Updater as soon as the Veeam update repository is updated. It is then rolled out to Veeam Software Appliance 13.1 installations and, gradually, to all Windows-based Veeam Backup & Replication 13.1 deployments. To upgrade right away, download the 13.1 installation media now from My Account. Security…

    Related products — impact not confirmed
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    • 13.1.2.11
    • 13.1.2.4
    • 13.1.2.2270
    • 13.1.1.18
    Source-reported fixed versions
    • Veeam Software Appliance 13.1
    • Veeam Agent for Microsoft Windows 13.1.2.812
    • Veeam Agent for Linux 13.1.2.11
    • Veeam Agent for Mac 13.1.2.4

    4 more entries in the full advisory.

    Mitigation guidance
    • Release Information for Veeam Backup & Replication 13 and Updates KB ID: 4738 Product: Veeam Backup & Replication | 13 | 13.1 Published: 2025-09-03 Last Modified: 2026-10-29 Release Information 13.1.2.57 2026-10-27 This cumulative patch addresses issues, reports, and feedback received from customers, partners, service providers, and the community.
    • Upgrade to the latest version and receive all future patches automatically through Veeam Updater.
    • This patch becomes available through Veeam Updater as soon as the Veeam update repository is updated.
    • To upgrade right away, download the 13.1 installation media now from My Account.

    4 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2021-35971 +51] List of Security Fixes and Improvements in Veeam Backup & Replication

    KB3103Source published

    This bulletin covers 52 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    List of Security Fixes and Improvements in Veeam Backup & Replication KB ID: 3103 Product: Published: 2020-03-02 Last Modified: 2026-10-20 Purpose 13.1.2.57 - @angular/core / common / compiler upgraded to version 21.2.20 - System. Security.Cryptography. Xml upgraded to version 10.0.10 - Microsoft. AspNetCore. Authentication.Negotiate upgraded to version 10.0.11 - decode-uri-component upgraded to version 0.5.0 - dompurify upgraded to version 3.4.15 - postcss upgraded to version 8.5.28 - OpenSSL upgraded to version 3.5.8 13.1.0.411 - CoreWCF.Primitives upgraded to version 1.8.1 - MailKit upgraded to version 4.17.0 - MimeKit upgraded to version 4.17.0 - OpenTelemetry upgraded to version 1.15.3 - SQLite upgraded to version 3.53.2 - curl upgraded to version 8.21.0 - zlib upgraded to version…

    Affected products in this advisory
    • Backup and Replication
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • List of Security Fixes and Improvements in Veeam Backup & Replication KB ID: 3103 Product: Veeam Backup & Replication | 10 | 11 | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 | 13 | 13.1 Published: 2020-03-02 Last Modified: 2026-10-20 Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup & Replication.
    • The goal of this article is to provide our customers' security and compliance teams with detailed information on security improvements between releases, in order to help them make an informed decision on whether it is critical to upgrade from their current Veeam Backup & Replication version to a latter one.
    • Added possibility to limit the number of logon sessions per user and to log off users after an inactivity period SMTP certificates validation was added for email notifications Network communication between CDP components is encrypted with TLS Disabled insecure TLS protocols in communication with VMware infrastructure zlib has been updated to version 1.2.13 OpenSSL version has been updated to 1.0.2ze Putty has been updated to version 0.76 11.0.1.1261 P20240304 VMware Virtual Disk Development Kit (VDDK) was updated to 7.0.3.4.
    Full advisory and evidenceOpen source bulletin

More Veeam advisories

All Veeam advisories

Follow CVE-2026-21708 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Veeam CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features