Eine Schwachstelle, die es einem lokalen Angreifer mit Administratorrechten ermöglicht, Windows Driver Signature Enforcement zu umgehen.

Successful exploitation of CVE-2026-21709 allows an attacker with local administrator access to bypass Windows Driver Signature Enforcement. This means they can install unsigned or improperly signed drivers onto the system. These malicious drivers could then be used to escalate privileges, compromise system integrity, or install malware. The blast radius is limited to systems where the attacker has local administrator access and Veeam Backup and Replication is installed. This bypass effectively removes a key security control designed to prevent the installation of malicious drivers, significantly increasing the attack surface.

Organizations heavily reliant on Veeam Backup and Replication for data protection are at risk, particularly those with legacy systems or configurations that may not enforce strict driver signing policies. Environments with shared administrator accounts or inadequate access controls are also more vulnerable, as a compromised administrator account could be leveraged to exploit this vulnerability.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*Veeam*'} | Format-Table TaskName, State

• windows / supply-chain:

Get-Process -Name VeeamBackup | Select-Object ProcessName, Path, CPU, WorkingSet

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Veeam.Backup.HostIntegrationService']]]" | Format-Table TimeCreated, ID, Message

1. 2026-04-17Disclosure

   disclosure

1. Reserviert2026-01-04
2. Veröffentlicht2026-04-17
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-25

The primary mitigation for CVE-2026-21709 is to upgrade Veeam Backup and Replication to version 13.0.1 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing stricter local administrator account controls and monitoring for suspicious driver installations. While a direct workaround is unavailable, reviewing Veeam's security best practices and ensuring proper driver signing policies are in place can reduce the potential impact. After upgrading, confirm the fix by attempting to install an unsigned driver and verifying that Driver Signature Enforcement is still enforced.