CVE-2026-21708: PostgreSQL SQL Injection to Remote Code Execution via Backup Viewer Role in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK

Target: Veeam Backup & Replication PostgreSQL Database Backend & Reporting Sinks

Confidence: 99%

99 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes Threat Score rates CVE-2026-21708 at 99 (CRITICAL). Because the web and API layers connect to PostgreSQL with administrative superuser privileges, a SQL injection exploitable by a read-only 'Backup Viewer' role instantly breaks database isolation and executes arbitrary operating system commands, facilitating complete takeover of the recovery plane.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-21708: Veeam Backup & Replication PostgreSQL SQL Injection to RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Disambiguation Notice: CVE-2026-21708 vs. CVE-2021-21708

Important Clarification: Security analysts and vulnerability scanners occasionally confuse CVE-2026-21708 with CVE-2021-21708.

• CVE-2021-21708 is a historical memory corruption (use-after-free) vulnerability in the PHP runtime (php_filter_float()), entirely unrelated to Veeam.
• CVE-2026-21708 is the critical vulnerability disclosed in Veeam’s March 12, 2026 security bulletin (KB4830 / KB4831) impacting Veeam Backup & Replication. This dossier covers the Veeam vulnerability in full technical depth.

Critical Severity: Read-Only Viewer to OS Superuser Command Execution

CVSS v3.1: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) / CVSS v4.0: 9.4 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’).
Affects Veeam Backup & Replication versions 12.0.0.1402 through 12.3.2.4465 (exclusive) and 13.x prior to 13.0.1.2067. An authenticated user assigned the minimal, read-only Backup Viewer role can inject arbitrary SQL commands and escape the database sandbox to execute operating system commands as the postgres system user. Addressed in KB4830 and KB4831.

Executive Summary

Disclosed on March 12, 2026, CVE-2026-21708 represents the most dangerous vulnerability in the Veeam KB4830 / KB4831 security bulletin.

Starting in VBR v12, Veeam introduced PostgreSQL as the default configuration database engine. In certain reporting and inventory query endpoints, user-supplied filter parameters were concatenated directly into dynamic SQL queries without parameterized statement binding. Crucially, the Veeam application connects to PostgreSQL using the postgres superuser account. As a result, an attacker with read-only “Backup Viewer” credentials can inject administrative SQL commands, invoke PostgreSQL’s programmatic execution functions (COPY ... FROM PROGRAM), and break out of the database engine to spawn arbitrary shell commands on the host operating system.

---

1. Vulnerability Metadata & Affected Surface

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-21708	Global tracking identifier
Vendor Advisories	Veeam KB4830 (v12) & KB4831 (v13)	Unified security update bundle
Affected Builds	VBR 12.x (12.0.0.1402 to < 12.3.2.4465) & 13.x (< 13.0.1.2067)	PostgreSQL database deployments
Patched Releases	VBR Build 12.3.2.4465 & 13.0.1.2067	Cumulative emergency release
Vulnerable Component	Database Query Dispatcher	Dynamic SQL generation routines
Required Role	Backup Viewer	Lowest privileged role in VBR RBAC
Database Connection	PostgreSQL Superuser (postgres)	Unrestricted SQL execution permissions
Impact	Remote Code Execution & Host Sandbox Escape	Full system and backup compromise

---

2. Technical Root Cause & Sandbox Escape Mechanics

The vulnerability stems from improper neutralization of input in dynamic SQL construction (CWE-89) combined with excessive database connection privileges.

CVE-2026-21708 SQL Injection to OS RCE Pipeline:

 [Authenticated Operator (Backup Viewer Role)]
        │
        │ 1. Submits crafted filter parameter via REST API / UI:
        │    param = "'; COPY (SELECT '') TO PROGRAM 'cmd.exe /c ...'-- "
        ▼
 [Veeam Backend Query Engine]
        │
        │ 2. Concatenates string directly into dynamic SQL statement
        ▼
 [PostgreSQL Server (TCP 5432)]
        │
        │ 3. Executes query under 'postgres' Superuser Account
        ▼
 [Database Sandbox Escape (CWE-89)]
        │
        │ 4. PostgreSQL spawns system shell via 'COPY ... FROM PROGRAM'
        ▼
 [Operating System Command Execution]
        └── Executes payload with postgres / LocalSystem privileges

The Superuser Privilege Escalation Vector

Under standard operational design, an operator assigned the Backup Viewer role is restricted to viewing job status, storage consumption, and historical task logs without permission to modify infrastructure.

However, because the application broker queries the database using a single, high-privileged connection pool authenticating as postgres, any parameter concatenation vulnerability completely bypasses application-level RBAC. By escaping the query context, the attacker issues:

'; CREATE TABLE cmd_exec(output text);
COPY cmd_exec FROM PROGRAM 'powershell -enc <Base64_Payload>';--

Because the PostgreSQL service possesses operating system execution capabilities, the injected COPY ... FROM PROGRAM command runs child processes directly under the database service account on the host.

---

3. Attack Chain & Ransomware Operationalization

In real-world adversary operations, CVE-2026-21708 completely alters the attacker’s risk calculus:

1. Low-Risk Account Abuse: Adversaries do not need to target highly audited administrator credentials. An audit account, service desk viewer account, or third-party monitoring integration holding Backup Viewer rights is sufficient.
2. Instant Host Takeover: Within seconds of sending a single HTTP POST request, the attacker obtains an interactive shell on the backup server.
3. Recovery Plane Destruction: From the host shell, the attacker extracts DPAPI keys, dumps Active Directory domain admin credentials, and issues disk-formatting commands to wipe backup repositories.

---

4. Detection Engineering

Sigma (PostgreSQL Spawning System Shells)

title: PostgreSQL Service Spawning Command Shell
id: 7c12f498-8b21-4f12-9912-cve-2026-21708-pgescape
status: production
description: Detects command shells or administrative utilities spawned directly by postgres.exe, indicative of CVE-2026-21708 SQL injection and sandbox escape.
references:
  - https://www.veeam.com/kb4830
  - https://www.veeam.com/kb4831
author: Hermes Codex DFIR Lab
date: 2026-09-09
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\postgres.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
  - cve.2026-21708

KQL (Sentinel PostgreSQL COPY Injection)

// Microsoft Sentinel KQL: Detect SQL Injection involving COPY FROM PROGRAM in PostgreSQL logs
Syslog
| where ProcessName == "postgres" or Facility == "local0"
| where SyslogMessage has_any ("COPY", "FROM PROGRAM", "TO PROGRAM")
| summarize
    IncidentCount = count(),
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    SampleQuery = take_any(SyslogMessage)
    by HostName, ProcessName
| where IncidentCount > 0

Suricata (SQL Injection Payload Signature)

# Suricata Rule: Detect Inbound COPY PROGRAM SQL Injection directed at Veeam Web / API Endpoints
alert http $EXTERNAL_NET any -> $VEEAM_SERVERS any ( \
    msg:"HERMES DEFENSE - Potential Veeam CVE-2026-21708 PostgreSQL COPY PROGRAM SQLi Attempt"; \
    flow:to_server,established; \
    content:"COPY"; nocase; http_uri; \
    content:"PROGRAM"; nocase; distance:0; http_uri; \
    classtype:web-application-attack; \
    sid:102621708; rev:1; \
    metadata:cve CVE-2026-21708, confidence high;)

YARA (SQL Injection Script Strings)

rule Exploit_Veeam_CVE_2026_21708_SQLi {
    meta:
        description = "Detects exploit scripts targeting Veeam CVE-2026-21708 PostgreSQL injection"
        author = "Hermes Codex CTI"
        date = "2026-09-09"
        severity = "Critical"
    strings:
        $s1 = "COPY" ascii wide nocase
        $s2 = "FROM PROGRAM" ascii wide nocase
        $s3 = "Backup Viewer" ascii wide nocase
        $v1 = "Veeam.Backup" ascii wide nocase
        $v2 = "12.3.2.4465" ascii wide
    condition:
        ($s1 and $s2 and ($v1 or $v2)) or
        (all of ($s*) and any of ($v*))
}

---

5. Defensive Hardening & Remediation

1. Apply Hotfix KB4830 / KB4831 Immediately: Update Veeam Backup & Replication 12 to 12.3.2.4465 and VBR 13 to 13.0.1.2067. The patch replaces all dynamic query concatenation with parameterized SQL prepared statements.
2. Audit & Restrict the Backup Viewer Role: Enumerate all users assigned the Backup Viewer role. Ensure that unnecessary accounts are revoked and that console MFA is enforced across all accounts regardless of privilege tier.
3. Database Network Isolation: Ensure the PostgreSQL service on TCP port 5432 listens exclusively on 127.0.0.1 and is completely inaccessible from external network interfaces.

---

6. Master Series Navigation & Related Intelligence

Part 1: Veeam Architecture & Threat Landscape Component topology, PostgreSQL database schema, and threat actor campaigns.

Part 2: Vulnerability Matrix & Exploitation Comparative breakdown of critical Veeam CVEs, deserialization flaws, and patch history.

Part 4: DFIR Forensic Investigation PostgreSQL database triage queries, inspecting session logs, and DPAPI key analysis.

CVE-2026-21669: Domain User RCE Technical analysis of authenticated domain user code execution in VBR v13.

---

7. Verified Citations & Primary Sources

Veeam Support - KB4830 Security Bulletin Official vendor security bulletin covering CVE-2026-21708 for Veeam Backup & Replication 12.

Wiz Research - Critical Vulnerabilities in Veeam Backup Infrastructure Technical research paper dissecting SQL injection to OS command execution via PostgreSQL.

CERT-FR - Bulletin d'alerte CERTFR-2026-AVI-0298 National advisory detailing critical vulnerabilities in Veeam Backup & Replication.

SentinelOne Vulnerability Database - CVE-2026-21708 Threat intelligence assessment and endpoint detection engineering profile for CVE-2026-21708.