An authenticated domain user can bypass repository access restrictions and modify or delete arbitrary files on a Veeam Backup and Replication repository. The vulnerability enables attackers with valid domain credentials to tamper with backup data, potentially corrupting restores or inserting malicious payloads, thereby compromising data integrity and availability.

The affected product is Veeam Backup and Replication. No specific version information is provided, so all supported releases that use the repository feature are potentially impacted.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% denotes a very low probability of exploitation in the wild. The vulnerability is not listed in the KEV catalog, indicating no confirmed exploits. The attack vector requires an authenticated domain user, so internal threat actors or compromised credentials can exploit this. No remote code execution occurs; the exploitation results in unauthorized file changes.