Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Microsoft Exchange Backup Server allows authenticated users to execute code remotely

CVE-2026-21669 · published 7 months ago
Summary

A security flaw in the Microsoft Exchange Backup Server allows authorized users to run unauthorized commands on the server, potentially leading to system compromise. This vulnerability affects Microsoft Exchange Backup Server and requires immediate attention to prevent unauthorized access to sensitive data. Users should update their Backup Server software to the latest version to mitigate this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
veeam veeam_backup_\&_replication >= 13.0.0.496, <= 13.0.1.1071
>= 13.0.0.496, < 13.0.1.2067
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-693Protection Mechanism Failure
Timeline
Published12 Mar 2026
Updated3 Nov 2026
First seen12 Mar 2026
Sources
CVE-2026-21669 · NVD
Track software like this
Free during beta