CVE-2026-21670

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21670", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-01-02T15:00:02.871Z", "datePublished": "2026-03-12T15:09:39.200Z", "dateUpdated": "2026-05-10T12:53:07.750Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A vulnerability allowing a low-privileged user to extract saved SSH credentials."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Veeam", "product": "Backup and Replication", "versions": [{"version": "13.0.1", "status": "affected", "lessThan": "13.0.1", "versionType": "semver"}]}], "references": [{"url": "https://www.veeam.com/kb4831"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-03-12T15:09:39.200Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:32:35.171553Z", "id": "CVE-2026-21670", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-10T12:53:07.750Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21670", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:32:35.171553Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:34:20.910Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "affected": [{"vendor": "Veeam", "product": "Backup and Replication", "versions": [{"status": "affected", "version": "13.0.1", "lessThan": "13.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.veeam.com/kb4831"}], "descriptions": [{"lang": "en", "value": "A vulnerability allowing a low-privileged user to extract saved SSH credentials."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-03-12T15:09:39.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21670", "state": "PUBLISHED", "dateUpdated": "2026-05-10T12:53:07.750Z", "dateReserved": "2026-01-02T15:00:02.871Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-03-12T15:09:39.200Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Backup and Replication", "vendor": "Veeam", "versions": [{"lessThan": "13.0.1", "status": "affected", "version": "13.0.1", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:veeam:veeam_backup_\\&_replication:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F7C6B2B-8DFE-4FF7-A990-04BB209D5031", "versionEndIncluding": "13.0.1.1071", "versionStartIncluding": "13.0.0.496", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability allowing a low-privileged user to extract saved SSH credentials."}, {"lang": "es", "value": "Una vulnerabilidad que permite a un usuario de bajo privilegio extraer credenciales SSH guardadas."}], "id": "CVE-2026-21670", "lastModified": "2026-06-17T10:18:53.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "support@hackerone.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21670", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:32:35.171553Z", "version": "2.0.3"}}]}, "published": "2026-03-12T15:16:13.510", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://www.veeam.com/kb4831"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.1,13.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Backup and Replication", "source": "cna", "vendor": "Veeam"}, "product": "backup_and_replication", "vendor": "veeam"}], "analysis": {"en": {"generated_at": "2026-04-01T06:51:09.320933+00:00", "value": {"mitigation_remediation": ["Apply the latest vendor patch for Veeam Backup and Replication as outlined in the Veeam knowledge base", "Limit local user privileges to prevent unauthorized access to the credential cache", "Monitor account activity and audit logs for abnormal attempts to retrieve SSH credentials"], "summary": {"action": "Immediate Patch", "impact": "Credential Theft"}, "threat_synthesis": {"affected_systems": "The affected product is Veeam Backup and Replication. Specific product versions are not listed, so any current release that does not include the vendor\u2019s fix may be vulnerable. The risk applies to all instances that store or cache SSH credentials for remote host access.", "description_and_impact": "Veeam Backup and Replication allows a low\u2011privileged user to extract stored SSH credentials, revealing authentication secrets that may be reused against remote systems managed by the backup appliance. The vulnerability is based on the weakness CWE\u2011522, a failure to protect credentials during storage or transmission. If exploited, an attacker can obtain valid SSH credentials, enabling further unauthorized access or lateral movement within an organization.", "risk_and_exploitability": "The CVSS score of 7.7 indicates a high severity impact if the flaw is exploited. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a local low\u2011privileged account on the Veeam appliance; based on the description, it is inferred that the attacker must have such access in order to read the cached credentials. No publicly available exploits have been disclosed, so the risk remains primarily theoretical until an attacker acquires local access."}}}}, "created": "2026-03-13T09:53:05.891627+00:00", "title": "Veeam Backup and Replication Low\u2011Privileged SSH Credential Extraction Vulnerability", "updated": "2026-04-02T08:00:21.745227+00:00", "vendors": ["veeam", "veeam$PRODUCT$backup_and_replication"]}