A flaw in Veeam:Backup and Replication’s Backup Viewer enables an attacker to execute arbitrary code with the privileges of the postgres user. This gives potential control over the PostgreSQL database service and could compromise database integrity, confidentiality, and availability.

The vulnerability impacts any deployment of Veeam:Backup and Replication that includes the Backup Viewer component. Specific product versions are not disclosed, so all installations that use this feature remain potentially exposed until a fix is applied.

The CVSS score is not provided, indicating that the exact severity has not been published. The EPSS score of < 1% indicates a low likelihood of current exploitation. The absence from the CISA KEV catalog does not lessen the risk, as the high‑impact potential demands urgent attention. The most likely exploitation path is through remote access to the Backup Viewer interface, where an attacker can supply crafted input to trigger code execution as the postgres user. Once executed, the attacker could gain further access or persist within the system.