Backup Server Security Is a Staffing Problem: What One Week of Critical Flaws Showed

Backup server security decides whether you can recover from ransomware or have to negotiate with it. In March 2026 one of the most widely used backup platforms shipped fixes for flaws that let any user with an ordinary company login run code on the backup server. Closing that kind of gap within days takes someone whose job is watching advisories and testing patches, which is why patching your backups is a staffing problem before it is a technology problem.

What happened in March 2026

On March 12, 2026, the maker of a widely deployed backup and replication platform published security fixes for its two supported versions. The Canadian Centre for Cyber Security issued an advisory the same day describing them as critical vulnerabilities and urging administrators to apply the updates. The National Vulnerability Database record for one of them states it plainly: "A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server."

Why backup server security is now the front line

Attackers go after backups first because backups are what let a victim refuse to pay. The #StopRansomware Guide from CISA, the FBI and NSA warns that "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid."

A backup server is also unusually powerful. It holds credentials to almost every system it protects, it can read every file, and it is often the least watched machine in the building. If someone gains code execution there, they hold both your data and your way back. Weak backup server security turns one stolen password into a full outage.

One platform, many advisories

The March fixes were not a one-off. The Canadian Centre for Cyber Security has tracked a steady run of fixes for the same platform, before and after this note first ran:

1. Jan 6, 2026 First fixes of the year. The vendor published a security advisory for its backup and replication product, according to the Centre.
2. Mar 12, 2026 Critical flaws. Fixes for both supported versions, including code execution by any domain user.
3. May 27, 2026 More fixes. A new advisory covered further vulnerabilities.
4. Sep 21, 2026 Exploited in the wild. The Centre updated the May advisory to say "open-source reporting indicates that CVE-2026-32996 is being exploited in the wild."
5. Oct 28, 2026 Another round. A further advisory listed more vulnerabilities in the vendor’s products.

Backup software is complex, widely deployed and valuable to attackers. Good backup server security assumes a steady stream of fixes and plans staffing around that, not around the next headline.

The gap between a patch and a patched server

A fix being published and a fix being installed are different events. In between sit the hard parts: noticing the advisory, finding every affected server, testing the update so it does not break the restore chain, scheduling the change, and checking afterwards that backups still run and still restore.

The National Institute of Standards and Technology frames this work in its patch management guide (SP 800-40 Rev. 4, April 2022) as "a critical component of preventive maintenance," part of the cost of doing business rather than an occasional project. That framing matters for backup server security, because at a 50-person company nobody's job is to read vulnerability feeds at 6 p.m. on a Wednesday.

Federal agencies get deadlines. For years, CISA's Binding Operational Directive 22-01 required them to fix newer flaws in its Known Exploited Vulnerabilities catalog within two weeks. In June 2026, after this note first ran, CISA replaced it with BOD 26-04, which sets remediation times by exposure, exploitation status, automation and impact, with some fixes due within three days. Private businesses are not bound by either directive, but attackers do not wait longer for them, so treat those windows as the bar for your own backup server security.

A backup server security routine for every patch

1. Confirm you are affected. Match the advisory's version list against every backup server, proxy and repository you run.
2. Take a known-good copy first. Make sure a recent offline copy exists before you touch the server.
3. Apply the fix in a quiet window. Schedule it between backup jobs so a failed update does not cost you a night of protection.
4. Run a job and a restore. Back something up, then restore it somewhere safe. A green status light is not proof.
5. Record it. Note the version, the date and who checked the restore, so the next advisory starts from facts.

Backup server security beyond patching

Patches close known holes. The rest of the work is making sure an attacker who gets in still cannot reach every copy. The same CISA guide sets out the basics of backup server security:

• Know what you run. List every backup server, proxy and repository, with its version and an owner.
• Watch the advisories. Someone named should read the vendor's security bulletins and CISA's exploited-vulnerability alerts every working day.
• Take it off the domain where you can. At least two of the March flaws needed only a domain login. A backup server that does not trust ordinary staff accounts removes that path. CISA's guide also says to "separate administrator accounts from user accounts."
• Keep an offline copy. CISA's guide says to "maintain offline, encrypted backups of critical data" and to "regularly test the availability and integrity of backups in a disaster recovery scenario."
• Keep golden images. The guide recommends maintaining "golden images" of critical systems, preconfigured templates you can redeploy to rebuild a server quickly.
• Use immutable storage carefully. Some providers offer storage that cannot be changed once written. CISA's guide says to "use immutable storage with caution as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost."

The older rule of thumb still holds as a floor. A US-CERT paper on data backup options sets out the 3-2-1 rule: three copies of important files, on two different media types, with one copy stored offsite. The ransomware guidance adds the part that rule leaves out: at least one copy has to be out of an attacker's reach.

Managed infrastructure closes the gap

The argument for managed infrastructure is not that an outside team is smarter than yours. It is that patch speed comes from staffing, tooling and process, and those cost money whether you build them in-house or not. When infrastructure is someone's whole job, advisories get read the day they land and backup server security stops depending on who happens to be free that week.

LTFI runs each company on its own server, which Kief Studio hosts, patches and watches, with no other business’s data on it. Backups and recovery are part of the service, built so the copies can actually be restored, and keys and secrets never sit in chat or on a shared machine. One customer's missed patch never becomes another customer's problem. Our security layer explains how we protect client systems, the hardening layer covers what runs on every server, and our note on dedicated versus shared hosting walks through the cost side.

If your backup platform is running an old version right now, talk to us about your infrastructure.

Frequently asked questions