A flaw in Veeam Backup and Replication permits an authenticated domain user to run arbitrary code on the Backup Server, which can lead to full compromise of confidentiality, integrity, and availability; the issue results from improper access control and is identified as CWE‑284.

Affected systems are installations of Veeam Backup and Replication. No specific release numbers are listed, so all versions should be treated as vulnerable until a vendor update is applied.

The CVSS score of 10 reflects maximum severity, yet the EPSS score is below 1 % and the vulnerability is not in the CISA KEV catalog. The likely attack method involves a domain user who authenticates to the backup server and submits malicious input that is executed with the service’s privileges. No public exploit has been reported, but the combination of required authentication with remote code execution makes this a high‑risk issue for any compromised account.