CVE-2026-21669: Authenticated Domain User Remote Code Execution in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK

Target: Veeam Backup & Replication v13 Control Plane - RPC Management Endpoint

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes Threat Score rates CVE-2026-21669 at 98 (CRITICAL). In an enterprise Windows Active Directory environment, this vulnerability transforms any compromised low-privileged domain user account into full NT AUTHORITY\SYSTEM execution on the primary backup server. Because the backup server maintains the entire recovery baseline and privileged infrastructure credentials, this flaw facilitates instant enterprise-wide ransomware extortion.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-21669: Veeam Backup Catalog Service Pre-Auth Binary Deserialization RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Severity: Instant Domain User to SYSTEM Elevation

CVSS v3.1: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) / CVSS v4.0: 9.4 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-285: Improper Authorization / CWE-287: Improper Authentication.
Affects Veeam Backup & Replication 13.x versions 13.0.1.1071 and earlier installed on domain-joined Windows machines. Any authenticated Active Directory domain user can execute arbitrary code with NT AUTHORITY\SYSTEM privileges on the backup server without needing any assigned Veeam administrative roles. Addressed in KB4831 (Build 13.0.1.2067).

Executive Summary

On March 12, 2026, Veeam released security advisory KB4831, disclosing CVE-2026-21669, a maximum-severity vulnerability in the newly deployed Veeam Backup & Replication 13.x control plane.

The vulnerability resides within an internal administrative RPC interface exposed by the core management daemon. While the endpoint validates that incoming callers hold valid Kerberos or NTLM domain authentication tokens, it fails to verify whether the authenticated identity belongs to an authorized Veeam operator role. Consequently, any compromised domain identity—such as a compromised standard workstation user or a service account with zero special rights—can issue privileged calls directly to the RPC endpoint and achieve arbitrary code execution as NT AUTHORITY\SYSTEM.

---

1. Vulnerability Metadata & Affected Surface

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-21669	Global vulnerability tracking identifier
Vendor Advisory	Veeam KB4831	Dedicated security update for VBR v13
Affected Builds	VBR 13.x $\le$ 13.0.1.1071	Windows-based deployments
Patched Release	VBR Build 13.0.1.2067	Mandatory security cumulative hotfix
Vulnerable Service	Veeam.Backup.Service.exe	Core backup coordination daemon
Network Transport	MS-RPC over TCP / Named Pipes	Dynamic RPC endpoints & TCP port 9401
Authentication Barrier	Any valid Active Directory domain account	Standard domain user / machine account
Privilege Achieved	NT AUTHORITY\SYSTEM	Complete control of backup infrastructure

---

2. Technical Root Cause Analysis

The root cause of CVE-2026-21669 lies in an architectural authorization bypass in the inter-service communication pipeline of Veeam Backup & Replication 13.

CVE-2026-21669 Vulnerable Authorization Pipeline:

 [Compromised Domain User]
        │
        │ 1. Issues RPC Request with valid Kerberos Domain Token
        ▼
 [Veeam.Backup.Service.exe (RPC Endpoint)]
        │
        │ 2. Authenticates Domain Identity (Auth Succeeded)
        ▼
 [Missing Authorization Check (CWE-285)]
        │
        │ ⚠️ Fails to verify VBR Role (Admin / Operator / Viewer)
        ▼
 [Privileged Dispatcher Method]
        │
        │ 3. Executes command payload in service context
        ▼
 [NT AUTHORITY\SYSTEM Execution]
        └── Spawns arbitrary binary or creates backdoor accounts

The Domain Trust Assumption

When Veeam Backup & Replication is installed on a domain-joined Windows server, its RPC services register Service Principal Names (SPNs) and accept domain authentication. Under VBR 13.0.1.1071, an internal management RPC handler established the caller’s identity via RpcImpersonateClient() but omitted the mandatory Veeam.Backup.Security.AuthorizationManager.CheckAccess() enforcement check before invoking privileged backend execution routines.

An adversary who possesses valid credentials for any domain user (obtained via phishing, password spraying, or Kerberoasting) can bind to the RPC interface and pass commands directly to the backend executor, completely bypassing the console login requirements.

---

3. Attack Chain & Ransomware Operationalization

In an enterprise intrusion, CVE-2026-21669 provides threat actors (such as Akira, Qilin, or Fog) with an instantaneous privilege catapult:

1. Initial Domain Foothold: The adversary breaches a standard workstation via phishing or VPN credential stuffing, gaining access as DOMAIN\jdoe (standard unprivileged user).
2. Backup Server Discovery: The attacker queries Active Directory for registered Veeam SPNs or scans the internal network for open RPC ports:

   nltest /dclist:domain.local
   Get-ADComputer -Filter {ServicePrincipalName -like "*Veeam*"}

3. RPC Binding & Payload Delivery: Using a crafted RPC client, the attacker binds to the Veeam management interface and transmits an RPC execution request directing the service to spawn a privileged process.
4. Local Administrator & Persistence Creation: The service executes the payload under NT AUTHORITY\SYSTEM, creating a persistent local administrator and dumping DPAPI-encrypted credentials from the PostgreSQL database.
5. Decapitation & Hypervisor Wiping: With full SYSTEM control on the backup host, the attacker accesses hypervisor root passwords, terminates backup jobs, deletes repository volumes, and deploys ransomware payloads across the enterprise.

---

4. Detection Engineering

Sigma (RPC Process Execution)

title: Veeam Backup Service Anomalous Child Process Spawn
id: e4b2d198-7c41-49fa-9812-cve-2026-21669-spawn
status: production
description: Detects command execution spawned directly from Veeam.Backup.Service.exe indicative of CVE-2026-21669 exploitation by an authenticated domain user.
references:
  - https://www.veeam.com/kb4831
author: Hermes Codex DFIR Lab
date: 2026-09-09
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Veeam.Backup.Service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\whoami.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-21669

KQL (Sentinel RPC Infiltration)

// Microsoft Sentinel KQL: Detect anomalous network connections to Veeam RPC / port 9401 from non-management endpoints
let BackupServers = dynamic(["10.100.50.10", "10.100.50.15"]); // Replace with actual Veeam server IPs
DeviceNetworkEvents
| where RemoteIP in (BackupServers) and RemotePort in (9401, 135, 445)
| where not(LocalIP in (BackupServers))
| summarize
    ConnectionCount = count(),
    StartTime = min(Timestamp),
    EndTime = max(Timestamp),
    InitiatingProcesses = make_set(InitiatingProcessFileName)
    by DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName
| where ConnectionCount > 0
| order by ConnectionCount desc

YARA (Exploit Memory Artifacts)

rule Exploit_Veeam_CVE_2026_21669_Artifacts {
    meta:
        description = "Detects memory and payload artifacts of CVE-2026-21669 Veeam RPC exploitation"
        author = "Hermes Codex CTI"
        date = "2026-09-09"
        severity = "Critical"
    strings:
        $rpc1 = "Veeam.Backup.Service" ascii wide nocase
        $rpc2 = "VeeamRPCService" ascii wide
        $rpc3 = "ImpersonateClient" ascii wide
        $payload1 = "net user " ascii wide nocase
        $payload2 = "administrators /add" ascii wide nocase
    condition:
        ($rpc1 and $rpc2 and $rpc3) or
        ($rpc1 and any of ($payload*))
}

---

5. Defensive Hardening & Remediation

1. Apply Hotfix KB4831 Immediately: Upgrade all Veeam Backup & Replication 13 instances to build 13.0.1.2067 or higher. The update implements strict identity verification and role-based access control inside the RPC message dispatcher.
2. De-Domain the Backup Server (Architectural Mitigation): Remove the Veeam Backup Server from the production Active Directory domain immediately. If the server is in a dedicated standalone Workgroup or isolated Red Forest, domain users cannot authenticate to RPC endpoints.
3. Isolate Management Interfaces: Enforce Windows Firewall rules restricting TCP port 9401 and RPC endpoints exclusively to authorized administrative jump hosts.

---

6. Related Intelligence & Internal Master Series Navigation

Part 1: Veeam Architecture & Threat Landscape Comprehensive architecture topology, listening ports, and threat actor campaigns.

Part 2: Vulnerability Matrix & Exploitation Comparative breakdown of critical Veeam CVEs, deserialization flaws, and patch history.

Part 3: Hardening & Zero Trust Guide Out-of-domain isolation blueprint, Linux Hardened Repositories, and Four-Eyes authorization.

Threat Profile: Akira Ransomware Syndicate Analysis of Akira's weaponization of backup vulnerabilities and hypervisor destruction.

---

7. Verified Citations & Primary Sources

Veeam Support - KB4831 Security Advisory Official vendor security bulletin detailing CVE-2026-21669 and patch download for build 13.0.1.2067.

CERT-FR - Bulletin d'alerte CERTFR-2026-AVI-0298 French National Cybersecurity Agency (ANSSI) advisory regarding critical vulnerabilities in Veeam Backup & Replication.

Penligent Security - The Domain User RCE Vulnerability in VBR 13 Technical audit examining RPC impersonation failures on domain-joined backup planes.

SentinelOne Vulnerability Database - CVE-2026-21669 Threat intelligence assessment and endpoint detection engineering profile for CVE-2026-21669.

CVE-2026-20079: Cisco Secure FMC Perimeter Control Plane Takeover Technical dossier on edge unauthenticated root RCE on enterprise firewalls management plane.