A flaw in Veeam:Backup and Replication’s Backup Viewer enables an attacker to execute arbitrary code with the privileges of the postgres user. This allows the attacker to gain control over the PostgreSQL database service, potentially compromising database integrity, confidentiality, and availability.

The vulnerability impacts any deployment of Veeam:Backup and Replication that includes the Backup Viewer component. Specific product versions are not disclosed, so all installations that use this feature remain potentially exposed until a fix is applied.

The CVSS score of 9.9 indicates a critical severity. The EPSS score of < 1% shows a low likelihood of current exploitation. Though not listed in the CISA KEV catalog, the high‑impact potential demands urgent attention. The most likely exploitation path is through remote access to the Backup Viewer interface, where an attacker can supply crafted input to trigger code execution as the postgres user. Once executed, the attacker could gain further access or persist within the system.