The flaw, identified as a CWE-36 weakness, allows an authenticated user with a Backup Administrator role to write arbitrary files on a Linux‑based Veeam Backup & Replication server. The vulnerability permits the attacker to create, replace, or modify any file on the server, which could be used to drop malicious binaries, alter configuration, or otherwise compromise system integrity and availability. This leads to loss of confidentiality, integrity, or availability of the backup services.

Veeam Backup and Replication deployments running on Linux, where a user is granted the Backup Administrator role. The provided information does not specify affected versions, so any installation lacking the latest security update should be considered vulnerable.

The flaw has a CVSS score of 8.6, indicating high severity. No EPSS score is available, making the exploitation probability uncertain. It is not listed in the CISA KEV catalog. At minimum, the attacker must have authenticated access as a Backup Administrator, a privilege typically held by trusted personnel, but the broad rights associated with that role can still enable significant damage if the vulnerability is exploited.