An authenticated domain user can exploit a flaw in Veeam Backup and Replication to execute arbitrary code on the Backup Server. The vulnerability is an access control weakness that allows trusted users to run commands with the server’s privileges. Successful exploitation would let an attacker compromise the whole backup environment, potentially exposing stored backup data and allowing further lateral movement.

The affected product is Veeam Backup and Replication. Specific version information was not disclosed, so all variants running in an environment where domain users have normal login rights are potentially vulnerable.

The CVSS score of 10 indicates critical damage potential, while the EPSS score under 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not catalogued on KEV lists. Exploitation requires the attacker to have valid domain credentials and access to the backup server; consequently, the attack vector is internal and authenticated. Once authenticated, the attacker can launch the remote code execution to gain full control of the backup server.