Veeam warns admins to patch now as critical RCE flaws hit Backup & Replication

Backup vendor Veeam has released security updates to patch multiple vulnerabilities in its widely used Backup and Replication platform, including three critical flaws that could allow authenticated users to execute code on backup servers. Detailed in the company’s advisory KB4830, the vulnerabilities affect Veeam Backup & Replication 12.3.2.4165 and earlier version 12 builds, with fixes now available in build 12.3.2.4465. The disclosure covers five security issues in total, including three remote code execution (RCE) bugs and two high-severity vulnerabilities enabling file manipulation or privilege escalation. Each of the three critical flaws carries a CVSS score of 9.9 out of 10 and allows authenticated users to execute code on backup infrastructure components under certain conditions. Backup systems have become increasingly valuable targets for attackers, particularly ransomware operators, because compromising them can undermine recovery capabilities and enable data destruction or exfiltration at scale. Flaws allow privilege escalation and RCE The most serious issues addressed in the advisory are the RCE bugs that an authenticated domain user can exploit to execute code on the Veeam Backup Server or associated components. In practice, this means an attacker who already has some level of access within the environment, such as through compromised credentials, could leverage the flaws to take control of backup infrastructure. The three bugs are tracked as CVE-2026-21666, CVE-2026-21667, and CVE-2026-21708. The advisory also details two high-severity flaws. CVE-2026-21668 allows attackers with repository access to manipulate arbitrary files on backup infrastructure, potentially affecting stored backup data, and CVE-2026-21672, a local privilege escalation flaw, could enable attackers who already have limited access to elevate their privileges on the Veeam servers. The advisory said that some vulnerabilities were reported through Veeam’s bug bounty program on HackerOne, while others were discovered during internal testing. While Veeam did not mention any in-the-wild exploitation, the Backup and Replication bugs have been repeatedly weaponized in the past. Patches are available Veeam warned that organizations should apply the patched build promptly, noting that vulnerability disclosures frequently trigger attempts by attackers to reverse-engineer patches and develop exploits for unpatched systems. The issues were fixed in Veeam Backup & Replication 12.3.2.4465, and organizations running unsupported or older builds should assume they are vulnerable and upgrade immediately. The urgency around the latest bugs is amplified by the fact that Veeam Backup & Replication has repeatedly faced critical vulnerabilities in recent years, some of which have been actively exploited by attackers. In 2024, security agencies warned that ransomware groups were exploiting CVE-2024-40711, a critical flaw in the platform that allowed remote code execution without authentication. Attackers used the vulnerability to compromise backup servers and delete recovery data as part of ransomware campaigns. The pattern continued in 2025, when Veeam patched CVE-2025-23120, another critical RCE bug that allowed any authenticated domain user to execute code on a backup server in domain-joined environments. The steady stream of high-severity bugs, along with the history of real-world exploitation, makes timely patching critical for organizations running Veeam Backup & Replication. Organizations must treat backup systems as highly privileged infrastructure requiring strong access controls and isolation.

Backup vendor Veeam has released security updates to patch multiple vulnerabilities in its widely used Backup and Replication platform, including three critical flaws that could allow authenticated users to execute code on backup servers.

Detailed in the company’s advisory KB4830, the vulnerabilities affect Veeam Backup & Replication 12.3.2.4165 and earlier version 12 builds, with fixes now available in build 12.3.2.4465. The disclosure covers five security issues in total, including three remote code execution (RCE) bugs and two high-severity vulnerabilities enabling file manipulation or privilege escalation.

Each of the three critical flaws carries a CVSS score of 9.9 out of 10 and allows authenticated users to execute code on backup infrastructure components under certain conditions.

Backup systems have become increasingly valuable targets for attackers, particularly ransomware operators, because compromising them can undermine recovery capabilities and enable data destruction or exfiltration at scale.

Related Product

Related Product

CrowdStrike Advanced Defend

by CrowdStrike$15.41/mo

CrowdStrike provides advanced cloud-native platform protection for endpoints, cloud workloads, identities, and data with a single lightweight agent.

Learn More

Flaws allow privilege escalation and RCE

The most serious issues addressed in the advisory are the RCE bugs that an authenticated domain user can exploit to execute code on the Veeam Backup Server or associated components. In practice, this means an attacker who already has some level of access within the environment, such as through compromised credentials, could leverage the flaws to take control of backup infrastructure. The three bugs are tracked as CVE-2026-21666, CVE-2026-21667, and CVE-2026-21708.

The advisory also details two high-severity flaws. CVE-2026-21668 allows attackers with repository access to manipulate arbitrary files on backup infrastructure, potentially affecting stored backup data, and CVE-2026-21672, a local privilege escalation flaw, could enable attackers who already have limited access to elevate their privileges on the Veeam servers.

The advisory said that some vulnerabilities were reported through Veeam’s bug bounty program on HackerOne, while others were discovered during internal testing. While Veeam did not mention any in-the-wild exploitation, the Backup and Replication bugs have been repeatedly weaponized in the past.

Related Product

Related Product

SentinelOne Control

by SentinelOne$8.00/mo

Prevention and detection of attacks across all major vectors with fully automated, policy-driven response capabilities and real-time forensics.

Learn More

Patches are available

Veeam warned that organizations should apply the patched build promptly, noting that vulnerability disclosures frequently trigger attempts by attackers to reverse-engineer patches and develop exploits for unpatched systems.

The issues were fixed in Veeam Backup & Replication 12.3.2.4465, and organizations running unsupported or older builds should assume they are vulnerable and upgrade immediately. The urgency around the latest bugs is amplified by the fact that Veeam Backup & Replication has repeatedly faced critical vulnerabilities in recent years, some of which have been actively exploited by attackers.

In 2024, security agencies warned that ransomware groups were exploiting CVE-2024-40711, a critical flaw in the platform that allowed remote code execution without authentication. Attackers used the vulnerability to compromise backup servers and delete recovery data as part of ransomware campaigns. The pattern continued in 2025, when Veeam patched CVE-2025-23120, another critical RCE bug that allowed any authenticated domain user to execute code on a backup server in domain-joined environments.

The steady stream of high-severity bugs, along with the history of real-world exploitation, makes timely patching critical for organizations running Veeam Backup & Replication. Organizations must treat backup systems as highly privileged infrastructure requiring strong access controls and isolation.

Originally published on March 13, 2026 by CSO Online.

Related Articles

Security, Vulnerabilities

Meet Fragnesia, the third Linux kernel vulnerability in a month

Linux admins reeling from handling last month’s CopyFail and last week’s Dirty Frag kernel vulnerabilities have a new headache to deal with: Fragnesia. “This is a significant vulnerability,” Robert Beggs, head of incident response firm DigitalDefence, told CSO. “It is bypassing traditional filesystem permissions that are present and enforced (for example, ‘file is owned by root’, or ‘file is read-only’) to allow manipulation without touching the disk.” Similar to Dirty Frag, Fragnesia (CVE-2026-46300) is a local privilege escalation hole that exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel. XFRM is an IP framework intended for packet transformations, and ESP-in-TCP (Encapsulating Security Payload in TCP) is a networking technique used to encapsulate IPsec ESP packets inside TCP segments. A proof of concept (PoC) exploit is already publicly available. The good news, Beggs said, is that the vulnerability can’t be exploited remotely. An attacker needs local access to trigger specific code paths and be able to control local socket operations and manipulate packet fragmentation. Still, he added, any unprivileged user can exploit the bug on a vulnerable system to corrupt security-sensitive files in memory, such as privileged access management configuration, password, systemd service files, or cron jobs. Although the attacker cannot modify the file on the disk, modifying in-memory files can trick privileged processes, alter system behavior, execute arbitrary code, and escalate privileges on the system, he said. Linux distributions including Red Hat, Ubuntu, AlmaLinux and others are pushing out patches or mitigations; CloudLinux said a patch is being tested. In a statement to CSO, Mike McGrath, Red Hat’s vice-president of Core Platforms, said issuing mitigations and fixes for privilege escalations like Fragnesia are a top priority. “We have published workarounds for the esp4 and esp6 kernel modules that we feel provide protection to customers in the immediate term while we work with the upstream community to identify a permanent fix in the form of a patch,” he said. According to Linux support provider TuxCare, systems running the affected skbuff code paths, including kernels that have already received the Dirty Frag fix, are impacted. The public PoC requires systems with the configuration option CONFIG_INET_ESPINTCP to access the bug, so kernels built without it block this exploit. But the underlying skbuff defect may be reachable through other paths. Microsoft urges Linux users and organizations to apply the patch as soon as possible by running update tools. If patching is not possible at this point, consider applying the same mitigations as for Dirty Frag, such as assessing whether esp4, esp6, and related xfrm/IPsec functionality can be temporarily disabled safely, restricting unnecessary local shell access, hardening containerized workloads, and increasing monitoring for abnormal privilege escalation activity. Related content: Kill switch for Linux kernel features proposed to improve security Beggs advises system administrators to confirm kernel exposure by reviewing version numbers, and then update to a patched kernel if necessary and reboot the affected system. If ESP-in-TCP is not required, disable the module and block its use; this mitigation can also be immediately applied until patching is complete. Because the vulnerability requires local access, make sure that basic steps such as enforcing MFA for privileged accounts, disabling of unneeded shell access, and enforcing least privilege are all in place. Beggs also said admins may wish to increase monitoring of privileged processes (PAM, systemd, cron) and look for unexpected restarts, unexpected config reloads, and sudden privilege escalations.

Security, Vulnerabilities

Flaws in four popular VS Code extensions left 128 million installs open to attack

Critical and high-severity vulnerabilities were found in four widely used Visual Studio Code extensions with a combined 128 million downloads, exposing developers to file theft, remote code execution, and local network reconnaissance. Application security company OX Security published the findings this week, saying it had begun notifying vendors in June 2025 but received no response from three of the four maintainers. Three CVEs, CVE-2025-65717, CVE-2025-65715, and CVE-2025-65716, were formally assigned and published on February 16. VS Code extensions are add-ons that expand the functionality of Microsoft’s widely used code editor, adding capabilities such as language support, debugging tools, live preview, and code execution. They run with broad access to local files, terminals, and network resources, which is what made these vulnerabilities consequential. Unlike the rogue extensions that threat actors have repeatedly planted in the VS Code marketplace, these flaws resided in legitimate, widely installed tools, meaning developers had no reason to suspect them, OX Security said in an advisory. “Our research demonstrates that a hacker needs only one malicious extension, or a single vulnerability within one extension, to perform lateral movement and compromise entire organizations,” the advisory added. The vulnerabilities also affected Cursor and Windsurf, the AI-powered IDEs built on VS Code’s extension infrastructure. OX Security published individual advisories for each flaw, detailing how each could be exploited and what an attacker could achieve. How the attacks worked The most severe flaw, CVE-2025-65717 (critical), was in Live Server, a 72-million-download extension that launches a local HTTP server for real-time browser previews. OX Security found the server was reachable from any web page a developer visited while it was running, not just their own browser. “Attackers only need to send a malicious link to the victim while Live Server is running in the background,” OX Security researchers Moshe Siman Tov Bustan and Nir Zadok wrote in an advisory. CVE-2025-65715 (high severity) affected Code Runner, with 37 million downloads. The extension reads execution commands from a global configuration file, and OX Security found a crafted entry that was enough to trigger arbitrary code execution, including reverse shells. An attacker could place it by phishing a developer into pasting a malicious snippet, or through a compromised extension that modified the file silently. CVE-2025-65716 (CVSS 8.8) affected Markdown Preview Enhanced, with 8.5 million downloads. Simply opening an untrusted Markdown file was enough to trigger it. “A malicious Markdown file could trigger scripts or embedded content that collects information about open ports on the victim’s machine,” the researchers noted. Microsoft quietly patched its own extension The fourth vulnerability played out differently. Microsoft’s Live Preview extension, with 11 million downloads, contained a cross-site scripting flaw that, according to OX Security, let a malicious web page enumerate files in the root of a developer’s machine and exfiltrate credentials, access keys, and other secrets. The researchers reported the issue to Microsoft on August 7. Microsoft initially rated it as low severity, citing required user interaction. “However, on September 11, 2025 — without notifying us — Microsoft quietly released a patch addressing the XSS security issues we reported. We only recently discovered that this patch had been deployed,” the researchers added. No CVE was assigned to this vulnerability. “Users with Live Preview installed should update to version 0.4.16 or later immediately,” the researchers suggested. Microsoft did not immediately respond to a request for comment. Taken together, the four flaws pointed to a broader problem with how developer tools are secured and maintained. What security teams should do “These vulnerabilities confirm that IDEs are the weakest link in an organization’s supply chain security,” the researchers at OX Security said in the advisory. Developer workstations routinely hold API keys, cloud credentials, database connection strings, and SSH keys. OX Security warned that a successful exfiltration from a single machine could give an attacker access to an organization’s broader infrastructure and that the risks extended to lateral movement and full system takeover. The researchers advised developers to disable extensions not actively in use and avoid browsing untrusted sites while localhost servers are running. They also cautioned against applying configuration snippets from unverified sources to VS Code’s global settings.

Security, Vulnerabilities

Actively exploited Cisco UC bug requires immediate, version‑specific patching

Cisco has released patches for a critical remote code execution vulnerability in its unified communications products that attackers are actively exploiting. The US Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, confirming the exploitation. Cisco disclosed CVE-2026-20045 along with patches for Unified Communications Manager, Unity Connection, and Webex Calling Dedicated Instance. The company assigned the vulnerability a “Critical” severity rating despite its CVSS score of 8.2. [ Related: More Cisco news and insights ] “Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates,” the company said in its advisory. “The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.” CISA’s addition of the vulnerability to its KEV catalog confirms attackers are exploiting it in the wild. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA said in its alert. This is the second actively exploited Cisco vulnerability CISA has added to its KEV catalog in recent weeks. Last week, the agency added CVE-2025-20393, affecting Cisco’s AsyncOS software. “Other collaboration products, including Contact Center Enterprise, Emergency Responder, Finesse, Unified Intelligence Center, and Unified Contact Center Express, are not vulnerable to CVE-2026-20045,” the advisory added. Root-level compromise with no user interaction The vulnerability stems from improper validation of user-supplied input in HTTP requests. “An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device,” Cisco explained in the advisory. “A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.” The attack requires no user interaction and can be carried out by unauthenticated remote attackers, making it particularly dangerous for internet-facing unified communications deployments, the advisory added. Cisco’s Product Security Incident Response Team added that it is “aware of attempted exploitation of this vulnerability in the wild,” underscoring the urgency of patching. No workarounds available Cisco confirmed in the advisory that there are no workarounds or mitigations available for CVE-2026-20045. The company has released fixes specific to each product version. For Unified Communications Manager, IM&P, SME, and Webex Calling Dedicated Instance running version 14, the company suggested administrators can upgrade to version 14SU5 or apply a version-specific patch file. Organizations running version 15 can apply version-specific patches for 15SU2 and 15SU3a, with a full release of version 15SU4 expected in March 2026, the company added. Unity Connection administrators have similar options, with version-specific patch files available for releases 14SU4 and 15SU3. Organizations still running version 12.5 face a harder choice: Cisco won’t release patches for this version and recommends migrating to a supported release. “Customers are advised to migrate to a supported release that includes the fix for this vulnerability,” Cisco said in the advisory. Patches are version-specific, and administrators should consult the README files attached to each patch for deployment details, the advisory added. Federal agencies face a deadline CISA’s inclusion of CVE-2026-20045 in the KEV catalog triggers mandatory remediation timelines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01. Federal agencies must patch the vulnerability within two weeks of its January 21 addition to the catalog. While BOD 22-01 applies specifically to federal agencies, CISA “strongly recommends” that all organizations treat KEV-listed vulnerabilities as high-priority patching targets. The catalog tracks flaws with confirmed active exploitation, making them significantly more likely to be weaponized against a broader range of targets. How to patch Cisco said organizations should check for signs of potential compromise on all internet-accessible instances after applying mitigations. The company advised administrators to review system logs and configurations for any unauthorized changes or suspicious activity that may indicate prior exploitation. For organizations unable to immediately upgrade to fixed releases, the company said version-specific patch files offer an interim remediation option. However, Cisco noted that patches must match the exact software version running on the device, and administrators should verify compatibility before deployment. More Cisco news: Cisco’s 2026 agenda prioritizes AI-ready infrastructure, connectivity Cisco finally patches seven-week-old zero-day flaw in Secure Email Gateway products Cisco routers knocked out due to Cloudflare DNS change Cisco identifies vulnerability in ISE network access control devices Attackers bring their own passwords to Cisco and Palo Alto VPNs Cisco confirms zero-day exploitation of Secure Email products Cisco defines AI security framework for enterprise protection Cisco initiative targets device security Key takeaways from Cisco Partner Summit AI networking demand fueled Cisco’s upbeat Q1 financial Cisco launches AI infrastructure, AI practitioner certifications