An authenticated domain user can bypass access restrictions and modify or delete arbitrary files on a Veeam Backup and Replication repository. This allows an attacker with valid domain credentials to tamper with backup data, potentially corrupting restores, or placing malicious payloads, thereby compromising data integrity and availability.

The affected product is Veeam Backup and Replication. No version details are provided, and the issue applies to all supported releases using the repository feature.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the KEV catalog, suggesting that there have been no confirmed exploits. The attack vector requires an authenticated domain user, so internal threat actors or compromised credentials can exploit this. No remote code execution is implied; the exploitation results in unauthorized file changes.