PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-21670 Veeam CVE debrief

CVE-2026-21670 is a high-severity Veeam issue that can let a low-privileged user extract saved SSH credentials. NVD maps the affected product to Veeam Backup & Replication and lists the vulnerable version range as 13.0.0.496 through 13.0.1.1071. Because the flaw exposes credentials, the main risk is unauthorized access to systems reachable with those SSH keys or passwords, especially where stored credentials are reused.

Vendor
Veeam
Product
CVE-2026-21670
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-12
Original CVE updated
2026-05-10
Advisory published
2026-03-12
Advisory updated
2026-05-10

Who should care

Veeam Backup & Replication administrators, security teams responsible for backup infrastructure, and anyone who stores SSH credentials in the affected Veeam environment.

Technical summary

NVD classifies the weakness as CWE-522 (insufficiently protected credentials) and assigns CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The issue requires low privileges but no user interaction, and its confidentiality impact is high because saved SSH credentials can be exposed. The supplied NVD data indicates affected versions from 13.0.0.496 through 13.0.1.1071 inclusive.

Defensive priority

High. Credential exposure on a backup platform can cascade into broader infrastructure access, so affected systems should be identified and remediated promptly.

Recommended defensive actions

  • Check whether any Veeam Backup & Replication deployments fall within versions 13.0.0.496 through 13.0.1.1071.
  • Follow the vendor advisory at KB4831 for remediation guidance and upgrade to a version outside the affected range.
  • Rotate any SSH credentials that may have been stored in the affected Veeam instance, especially reusable or privileged keys.
  • Review access controls so low-privileged accounts cannot reach credential stores or backup configuration data.
  • Audit logs and related administrative activity for signs that saved credentials may have been accessed.

Evidence notes

All product and version-range details come from the supplied NVD record, which cites the Veeam vendor advisory https://www.veeam.com/kb4831 as a reference. The weakness is mapped to CWE-522, and the CVSS vector in the source is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. No exploit steps or unverified impact claims are included.

Official resources

Publicly disclosed on 2026-03-12 and later modified in NVD on 2026-05-10. This debrief uses the supplied publication date for timing context.