A flaw in Veeam Backup and Replication allows an authenticated domain user to execute arbitrary code on the Backup Server. The vulnerability permits an attacker to gain full control of the server, leading to compromise of backup data, and potentially allowing lateral movement within the environment. The weakness falls under CWE-502, indicating an insecure deserialization issue that can directly lead to remote code execution.

Veeam Backup and Replication is the affected product. No specific product versions are listed in the available data, so all installations of the Backup Server component are potentially impacted.

The CVSS score of 9.4 categorizes this as Critical, indicating a severe threat. The EPSS score is not available, but the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation yet. The likely attack vector requires an authenticated domain user with access to the Backup Server, which limits exposure to users with domain credentials but still poses a high risk due to the ability to fully compromise the server.