A flaw in Veeam Backup and Recovery’s Backup Viewer enables an attacker to execute arbitrary code with the privileges of the postgres user. This gives potential control over the PostgreSQL database service and could compromise database integrity, confidentiality, and availability.

The vulnerability impacts any deployment of Veeam Backup and Recovery that includes the Backup Viewer component. Specific product versions are not disclosed, so all installations that use this feature remain potentially exposed until a fix is applied.

The CVSS score of 10 reflects maximum severity, while the EPSS score of 1% indicates a low likelihood of current exploitation. The absence from the CISA KEV catalog does not lessen the risk, as the high score demands urgent attention. The most likely exploitation path is through remote access to the Backup Viewer interface, where an attacker can supply crafted input to trigger code execution as the postgres user. Once executed, the attacker could gain further access or persist within the system.