The vulnerability is an input‑sourced code injection (CWE‑94) that allows an authenticated domain user to execute arbitrary code on the Veeam Backup Server when the vulnerable component is triggered. The impact is the ability to run arbitrary commands with the permissions of the server process, potentially compromising the entire Veeam infrastructure and any data it manages.

Affected systems include the Veeam Backup and Replication product, specifically the Backup Server component. Version information is not provided in the available data.

The risk assessment indicates an extremely high severity, with a CVSS score of 10. However, the EPSS score is under 1%, suggesting that there are currently no widely deployed public exploits. The vulnerability requires authenticated access as a domain user, meaning that attackers with domain credentials can exploit the flaw, but no anonymous or public network access is required. The absence from the KEV catalog further indicates that no publicly documented active exploitation has been reported.