The vulnerability in Veeam Backup for Microsoft 365 allows a user assigned the Administrator role to read arbitrary files located on the backup server. This flaw results in unauthorized disclosure of potentially sensitive files, compromising the confidentiality of backup data. The weakness is a missing authorization check, classified as CWE-863, which permits file reads beyond the intended scope of the role.

Affected product: Veeam Backup for Microsoft 365. All deployments of this product that include an Administrator role are impacted, regardless of version, as specific vulnerable releases are not identified in the public data.

The CVSS score of 8.3 indicates a high severity vulnerability. While the EPSS score is not available, the lack of a KEV listing suggests that no large‑scale exploitation has been reported yet. The flaw is exploitable by users who already possess the Administrator role. Based on the description, the attacker must have local or remote means to acquire that role, which is an inference. The impact is primarily confidentiality breach, as the attacker can read any file on the backup server with LocalSystem privileges.