A two‑step attack against the RESTful API of N2WS Backup & Recovery can lead to arbitrary code execution. The weakness is a race condition that allows an attacker to manipulate the execution sequence of concurrent requests, enabling them to run malicious code with the privileges of the backup service. This could compromise the entire server, allowing full control over files, configuration, and potentially all data handled by the application.

The vulnerability applies to N2WS Backup & Recovery versions prior to 4.4.0. All installations running the API exposed before this release are at risk, regardless of other configuration settings.

The CVSS score of 9 indicates a high severity level. The EPSS score of less than 1% shows that documented exploits are unlikely to be widely available. The vulnerability is not listed in the CISA KEV catalog, but the exploit path relies on exposure of the REST API over a network. Attackers who can reach the API endpoint can perform the dual‑step maneuver to trigger the race condition, leading to code execution without additional privileges.