CVE-2026-21670: Low-Privileged Saved SSH Credential Extraction in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & CREDENTIAL RISK

Target: Veeam Backup & Replication Credential Management Service - SSH Key Store

Confidence: 99%

89 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 17 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes Threat Score rates CVE-2026-21670 at 89 (HIGH). In environments utilizing Linux repositories, hypervisors, or cloud proxies, this vulnerability allows low-privileged backup operators to extract saved SSH private keys and credentials, enabling unauthorized lateral movement across the enterprise Linux server estate.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-21670: Veeam Backup Service WCF Impersonation Privilege EscalationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

High Severity: Broken Object Level Authorization in Credential Store

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) / CVSS v4.0: 8.4 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) / CWE-863: Incorrect Authorization / CWE-639: Authorization Bypass Through User-Controlled Key.
Affects Veeam Backup & Replication 12.x versions prior to 12.3.2.4465 and 13.x versions prior to 13.0.1.2067. An authenticated user with restricted permissions (such as Restore Operator or Tape Operator) can retrieve plaintext SSH private keys and credentials stored for managed Linux servers. Addressed in KB4830 and KB4831.

Executive Summary

Disclosed on March 12, 2026, in Veeam security bulletins KB4830 and KB4831, CVE-2026-21670 represents a critical privilege boundary failure within the VBR credential management subsystem.

Veeam Backup & Replication maintains a catalog of credentials used to interact with managed infrastructure components (Linux backup proxies, hardened repositories, hypervisors). Due to insufficient authorization checks in the credential retrieval API, low-privileged authenticated users who are intended to have read-only or task-specific access can enumerate and extract sensitive SSH private keys and credentials, weaponizing them for immediate lateral movement.

---

1. Vulnerability Metadata & Affected Surface

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-21670	Global vulnerability tracking identifier
Vendor Advisories	Veeam KB4830 (v12) & KB4831 (v13)	Security hotfix bulletins
Affected Versions	VBR 12.x < 12.3.2.4465 & 13.x < 13.0.1.2067	Enterprise backup installations
Patched Builds	VBR 12.3.2.4465 & 13.0.1.2067	Cumulative security releases
Vulnerable Service	Veeam.Backup.Service.exe	Credential provider RPC / REST handler
Compromised Asset	Saved SSH private keys & credentials	Root / administrative SSH access to Linux nodes
Required Privileges	Low-privileged authenticated Veeam user	Restore Operator, Tape Operator

---

2. Technical Root Cause & Exploitation Mechanics

The flaw is rooted in an Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) pattern within the credential service handler of Veeam.Backup.Service.exe.

CVE-2026-21670 Credential Extraction Flow:

 [Low-Privileged Operator (Restore Operator)]
        │
        │ 1. Authenticates to VBR API / Console
        ▼
 [Veeam Credential Management Service]
        │
        │ 2. Queries Credential Object by ID: GetCredentials(credId)
        ▼
 [Missing Object-Level Authorization]
        │
        │ ⚠️ Verifies only general API authentication, NOT record ownership
        ▼
 [DPAPI Decryption Invoked Internally]
        │
        │ 3. Service decrypts stored SSH Private Key / Password
        ▼
 [Plaintext SSH Private Key Returned to Operator]
        └── Used to establish root SSH session on Linux Repositories & Proxies

The Credential Store Architecture

When an administrator registers a Linux host in Veeam, the server can store SSH credentials (either username/password or OpenSSH private keys). These objects are stored in the configuration database under table [dbo].[Credentials] and encrypted using local machine DPAPI keys.

When a client application (such as the management console or REST API) requests credential metadata to populate UI dropdowns, the API endpoint GetCredentials() improperly returned full credential blobs—including decrypted private keys—to any authenticated session without verifying whether the requesting user held administrative rights to view secrets.

---

3. Lateral Movement & Enterprise Impact

The extraction of saved SSH private keys enables catastrophic lateral movement across the Linux enterprise tier:

1. Targeting Linux Proxies & Mount Servers: Attackers use extracted keys to log into Linux proxies as root or sudoer, establishing interactive shells.
2. Attacking Misconfigured Linux Repositories: If an organization failed to use single-use credentials or left SSH enabled on Linux repositories, an attacker possessing the private key can attempt to log in and tamper with non-immutable storage mounts.
3. Escaping to Hypervisor Enclaves: In environments where ESXi hosts or vCenter appliances utilize SSH authentication stored in Veeam, attackers pivot directly into hypervisor management interfaces.

---

4. Detection Engineering

Sigma (Suspicious Credential API Query)

title: Anomalous Veeam Credential Store Enumeration
id: 5a7f91c2-3e41-4820-9124-cve-2026-21670-dump
status: production
description: Detects rapid sequential queries to Veeam credential management endpoints by non-administrator accounts, indicative of CVE-2026-21670 exploitation.
references:
  - https://www.veeam.com/kb4830
  - https://www.veeam.com/kb4831
author: Hermes Codex DFIR Lab
date: 2026-09-09
logsource:
  category: application
  product: windows
detection:
  selection:
    Source: 'Veeam Backup Catalog'
    EventID: 100
    Message|contains:
      - 'GetCredentials'
      - 'FindCredentials'
      - 'ExportCredentials'
  filter_admin:
    User|contains:
      - 'Administrator'
      - 'VeeamAdmin'
  condition: selection and not filter_admin
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - cve.2026-21670

KQL (Sentinel SSH Lateral Pivot)

// Microsoft Sentinel KQL: Correlate Veeam low-privileged logins with immediate outbound SSH connections
let VeeamServers = dynamic(["10.100.50.10", "10.100.50.15"]);
let SuspiciousLogons = SecurityEvent
| where Computer in (VeeamServers) and EventID == 4624
| where TargetUserName !in ("Administrator", "SYSTEM")
| project LogonTime = TimeGenerated, TargetUserName, IpAddress;
DeviceNetworkEvents
| where InitiatingProcessFileName in ("ssh.exe", "putty.exe", "plink.exe") or RemotePort == 22
| join kind=inner (SuspiciousLogons) on $left.DeviceName == $right.Computer
| where TimeGenerated between (LogonTime .. (LogonTime + 15m))
| project TimeGenerated, TargetUserName, RemoteIP, RemotePort, InitiatingProcessCommandLine

YARA (SSH Private Key Dumps)

rule Hunt_Staged_Veeam_SSH_Keys {
    meta:
        description = "Detects extracted OpenSSH and RSA private keys dropped in temporary directories"
        author = "Hermes Codex CTI"
        date = "2026-09-09"
        severity = "High"
    strings:
        $ssh1 = "-----BEGIN OPENSSH PRIVATE KEY-----" ascii
        $ssh2 = "-----BEGIN RSA PRIVATE KEY-----" ascii
        $veeam_tag = "Veeam" ascii wide nocase
    condition:
        ($ssh1 or $ssh2) and $veeam_tag
}

---

5. Remediation & Hardening Recommendations

1. Apply Security Hotfixes KB4830 / KB4831: Update VBR 12 installations to 12.3.2.4465 and VBR 13 installations to 13.0.1.2067. The patch enforces strict role validation (Backup Administrator role required) prior to returning credential data.
2. Rotate Stored SSH Private Keys & Passwords: Immediately cycle all SSH keypairs and passwords stored in the Veeam credential manager for managed Linux proxies and hypervisors.
3. Audit User Role Allocations: Review all assigned roles in Veeam Console > Users and Roles. Ensure operators hold strictly minimal required permissions.

---

6. Master Series Navigation & Related Intelligence

Part 1: Veeam Architecture & Threat Landscape Component topology, credential store encryption, and threat actor campaigns.

Part 3: Hardening & Zero Trust Guide Guidance on single-use credentials and disabling SSH on Linux Hardened Repositories.

Part 4: DFIR Forensic Investigation Methods for detecting DPAPI credential extraction and triage script deployment.

CVE-2026-21669: Domain User RCE Technical analysis of authenticated domain user code execution in VBR v13.

---

7. Verified Citations & Primary Sources

Veeam Support - KB4830 Security Bulletin Official vendor security bulletin covering CVE-2026-21670 for Veeam Backup & Replication 12.

Tenable Network Security - CVE-2026-21670 Plugin Vulnerability assessment details and Nessus compliance scanning rules for CVE-2026-21670.

CERT-FR - Avis de sécurité CERTFR-2026-AVI-0298 National advisory detailing credential exposure and privilege escalation in Veeam software.

SentinelOne Vulnerability Database - CVE-2026-21670 Technical briefing on broken authorization flaws in backup management planes.