A flaw in the Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center allows an unauthenticated attacker to inject and execute arbitrary code. The vulnerability is rooted in improper deserialization of untrusted data, as identified by CWE-502. Successful exploitation would grant the attacker full control over the affected server, potentially compromising data, services, and network perimeter.

The service runs on servers that are part of the Veeam Management Pack for Microsoft System Center environment. No specific product version information is provided, but the issue exists in any instance of the Veeam Virtualization Extensions service that is installed as part of that management pack.

The flaw carries a CVSS score of 9.3, indicating critical severity. EPSS data is unavailable, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring no privileged access; an attacker can trigger the flaw from outside the network if the service is exposed. Given the high severity and the ability to execute code without authentication, the risk to any affected system is substantial.