CVE-2026-21672: Local Privilege Escalation on Windows Veeam Backup & Replication Servers

HERMES

HERMES THREAT SCORE & LOCAL PRIVILEGE RISK

Target: Windows Host Operating System & Local Veeam Background Services

Confidence: 99%

85 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 17 / 20

Exposure 16 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

Hermes Threat Score rates CVE-2026-21672 at 85 (HIGH). In host compromise scenarios where an attacker lands on the backup server as a low-privileged operator or service account, this flaw provides a deterministic path to achieve NT AUTHORITY\SYSTEM execution, opening the gateway to DPAPI credential extraction and repository erasure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-21672: Veeam Agent Configuration Service SSRF & Cloud Metadata TheftVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

High Severity: Local Privilege Escalation to SYSTEM

CVSS v3.1: 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 7.3 High (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) / CWE-276: Incorrect Default Permissions / CWE-732: Incorrect Permission Assignment for Critical Resource.
Affects Veeam Backup & Replication 12.x prior to 12.3.2.4465 and 13.x prior to 13.0.1.2067 deployed on Windows Server hosts. An authenticated local user with low privileges can manipulate service binary paths or shared directory ACLs to achieve arbitrary code execution as NT AUTHORITY\SYSTEM. Addressed in KB4830 and KB4831.

Executive Summary

Disclosed in the March 12, 2026 patch bundle (KB4830 and KB4831), CVE-2026-21672 represents a local privilege escalation flaw in the Windows host integration layer of Veeam Backup & Replication.

During installation, default Access Control Lists (ACLs) applied to specific operational subdirectories and DLL loading paths granted overly permissive write permissions to standard local users or the BUILTIN\Users security principal. An attacker who has secured an initial local foothold on the backup server—such as through a secondary compromised service account or non-administrative RDP session—can place a crafted dynamic-link library (DLL) or executable that is subsequently loaded by high-privilege Veeam system services, resulting in privilege escalation to NT AUTHORITY\SYSTEM.

---

1. Vulnerability Metadata & Affected Surface

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-21672	Global vulnerability tracking identifier
Vendor Advisories	Veeam KB4830 (v12) & KB4831 (v13)	Host security update bundle
Affected Builds	VBR 12.x < 12.3.2.4465 & 13.x < 13.0.1.2067	Windows Server installations
Patched Releases	VBR 12.3.2.4465 & 13.0.1.2067	Cumulative security patch
Vulnerable Layer	File System Access Control Lists (ACLs)	Service directory & DLL search paths
Required Privileges	Authenticated local user / service account	Low privilege on the Windows host
Privilege Achieved	NT AUTHORITY\SYSTEM	Complete host takeover & DPAPI master key access

---

2. Technical Root Cause & Exploitation Mechanics

The vulnerability stems from insecure default directory permissions and unsafe DLL search order resolution in local service wrappers.

CVE-2026-21672 Local Privilege Escalation Pipeline:

 [Low-Privileged Local User / Compromised Service Account]
        │
        │ 1. Identifies Writable Subdirectory with Insecure ACL (BUILTIN\Users: Write)
        ▼
 [File System Injection]
        │
        │ 2. Drops Malicious Hijack DLL (e.g., version.dll / dbghelp.dll)
        ▼
 [Veeam High-Privilege Service (Veeam.Backup.Service / MountService)]
        │
        │ 3. Service starts or triggers background task as LocalSystem
        ▼
 [DLL Search Order Hijack (CWE-732)]
        │
        │ 4. Service loads attacker DLL prior to System32 path
        ▼
 [NT AUTHORITY\SYSTEM Code Execution]
        └── Attacker payload executes with full kernel and DPAPI permissions

Insecure ACLs on Shared Logging & Staging Folders

Under vulnerable builds, subdirectories located under %ProgramData%\Veeam\Backup\ or temporary staging paths maintained inheritance flags that allowed standard local users write access. Furthermore, when background backup maintenance utilities executed, their binary loader paths evaluated application-specific directories ahead of %SystemRoot%\System32.

By dropping a proxy DLL implementing the exported function signatures of expected runtime dependencies, an attacker guarantees that the next routine service restart or automated maintenance job will execute the payload in the context of NT AUTHORITY\SYSTEM.

---

3. Threat Hunting & Detection Engineering

Sigma (DLL Hijack Placement)

title: File Creation of Suspicious DLL in Veeam Program Directories
id: 9a41b2c8-7f12-4120-8831-cve-2026-21672-hijack
status: production
description: Detects creation of DLL files in Veeam installation and data directories by non-administrative or unexpected user accounts, indicating potential CVE-2026-21672 exploitation.
references:
  - https://www.veeam.com/kb4830
  - https://www.veeam.com/kb4831
author: Hermes Codex DFIR Lab
date: 2026-09-09
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Veeam\Backup and Replication\'
      - '\ProgramData\Veeam\Backup\'
    TargetFilename|endswith: '.dll'
  filter_admin:
    User|contains:
      - 'AUTHORITY\SYSTEM'
      - 'Administrator'
      - 'TrustedInstaller'
  condition: selection_path and not filter_admin
level: high
tags:
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.t1068
  - cve.2026-21672

PowerShell (Audit Insecure Veeam ACLs)

# PowerShell: Inspect Veeam directories for insecure write permissions granted to Users
$VeeamPaths = @(
    "C:\Program Files\Veeam\Backup and Replication",
    "C:\ProgramData\Veeam\Backup"
)

foreach ($Path in $VeeamPaths) {
    if (Test-Path $Path) {
        Write-Host "[*] Auditing ACLs on: $Path" -ForegroundColor Cyan
        $Acl = Get-Acl -Path $Path
        $InsecureRules = $Acl.Access | Where-Object {
            $_.IdentityReference -match "Users" -and
            $_.FileSystemRights -match "Write|Modify|FullControl"
        }
        if ($InsecureRules) {
            Write-Host "[!] INSECURE PERMISSION FOUND: $Path allows write to Users" -ForegroundColor Red
            $InsecureRules | Select-Object IdentityReference, FileSystemRights, AccessControlType
        } else {
            Write-Host "[+] Clean: $Path enforces restrictive permissions" -ForegroundColor Green
        }
    }
}

KQL (Sentinel SYSTEM Escalation)

// Microsoft Sentinel KQL: Detect local privilege escalation from standard account to SYSTEM via Veeam services
SecurityEvent
| where EventID == 4672 // Special privileges assigned to new logon
| where SubjectUserSid != "S-1-5-18" // Exclude native SYSTEM startup
| where TargetUserName == "SYSTEM"
| join kind=inner (
    SecurityEvent
    | where EventID == 4688
    | where ParentProcessName has "Veeam" and NewProcessName in ("cmd.exe", "powershell.exe", "whoami.exe")
) on $left.SubjectLogonId == $right.TargetLogonId
| project TimeGenerated, Computer, TargetUserName, ParentProcessName, CommandLine

---

4. Defensive Hardening & Remediation

1. Apply Hotfixes KB4830 / KB4831: Update Veeam Backup & Replication to build 12.3.2.4465 or 13.0.1.2067. The update sanitizes default directory ACLs and enforces secure DLL loading configurations.
2. Restrict Local Host Access: Ensure no non-administrative users are permitted interactive or Remote Desktop (RDP) logons to the Veeam backup server. The backup server should exclusively host authorized administrators.
3. Audit Directory ACLs: Run the PowerShell auditing script above to confirm that BUILTIN\Users has only read and execute permissions across all Veeam program and data folders.

---

5. Master Series Navigation & Related Intelligence

Part 1: Veeam Architecture & Threat Landscape Component topology, credential store encryption, and threat actor campaigns.

Part 3: Hardening & Zero Trust Guide Guidance on single-use credentials, out-of-domain isolation, and host firewalling.

Part 4: DFIR Forensic Investigation Methods for detecting DPAPI credential extraction and triage script deployment.

Windows Forensics: Event 7045 & Service Modification Investigating suspicious service installations and persistence mechanisms.

---

6. Verified Citations & Primary Sources

Veeam Support - KB4830 & KB4831 Security Advisories Official vendor documentation addressing local privilege escalation in Veeam Backup & Replication.

NIST NVD - CVE-2026-21672 Detail National Vulnerability Database analysis, CVSS scoring breakdown, and CWE classifications.

CERT-FR - Bulletin d'alerte CERTFR-2026-AVI-0298 National advisory detailing privilege escalation vulnerabilities across Veeam software.

Wiz Research - Windows Local Privilege Escalation in Enterprise Applications Security analysis examining insecure ACL inheritance in enterprise backup software.