The vulnerability allows an attacker with local access to elevate privileges on a Windows-based Veeam Backup & Replication server, potentially granting administrative authority over the system and unauthorized manipulation of backup data. This weakness can compromise the confidentiality, integrity, and availability of the backed‑up data. The weakness is a form of improper access control, as classified by CWE‑284.

Veeam Backup & Replication engines running on Windows servers are affected. No specific product versions are listed in the CNA data, so all installations on Windows environment that use Veeam Backup & Replication should be considered at risk.

The CVSS score of 8.8 places the flaw in the high‑severity range, indicating significant impact if exploited. The EPSS score of less than 1 % suggests that exploitation is unlikely to be common in the wild, and the issue is not listed in CISA’s KEV catalogue. The likely attack vector is local: an attacker must already have some form of local access or be able to run code on the affected machine. While the probability of exploitation is low, the potential consequences warrant prompt attention and patching.