A membership of the Veeam Virtualization Extensions Users group can trigger remote code execution on servers that run the Veeam Management Pack for Microsoft System Center Collector service.

The vulnerability exists in the Veeam Management Pack for Microsoft System Center Collector service. No specific version information is provided, so any installation of this product that includes the vulnerable collector service is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the fact that all code executed by an attacker runs with the privileges of a member of the Veeam Virtualization Extensions Users group makes the attack likely to lead to a full system compromise if the attacker can authenticate to the host.