The vulnerability allows an attacker without credentials to bypass the authorization checks on the CDP Coordinator Service in Veeam Backup and Replication. This flaw, categorized as CWE‑636, means that an unauthenticated user can access privileged functionality that should be protected, potentially compromising the confidentiality, integrity, or availability of the system. The lack of authentication verification enables exploitation of any further capabilities provided by the service account.

All installations of Veeam Backup and Replication that include the CDP Coordinator Service are potentially affected. The advisory lists the product as Veeam:Backup and Replication, but no explicit version ranges are provided, so all current and older releases should be examined until patch information is released.

The CVSS score of 9.1 indicates a high‑severity, remote exploitation scenario. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote because the CDP Coordinator Service is typically exposed to the network; an unauthenticated attacker could send crafted requests to manipulate the service. Organizations should consider the possibility of chain exploitation to gain broader system control.