This vulnerability in Veeam Backup and Replication permits a user with the Backup Viewer role to execute arbitrary code with SYSTEM privileges on the backup server. As a result, an attacker who can authenticate as a Backup Viewer could gain full control of the backup server, read, modify, or delete any data, compromise backup integrity, or install persistent malware; the impact is equivalent to compromising the entire backup infrastructure.

Veeam Backup and Replication is affected. No version specifics are provided, so all releases that include the Backup Viewer role must be considered vulnerable until a vendor patch is applied. The flaw applies to any instance where a Backup Viewer account has been granted access to the backup server.

The CVSS score of 9.4 indicates a critical severity. The EPSS score is 5%, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need a legitimate Backup Viewer account to trigger the flaw, which typically has limited permissions; however, once authenticated, the vulnerability allows the attacker to achieve SYSTEM-level execution. Because there is no publicly reported exploitation data, the exact likelihood is unknown, but the high severity and privileged nature of the compromise warrant prompt remediation.