A flaw in Veeam Backup and Replication enables an authenticated domain user to execute arbitrary code on the Backup Server. The vulnerability permits full control over the server, and based on the description it is inferred that an attacker could compromise backup data and its integrity. The weakness is an instance of CWE‑502, insecure deserialization, which can directly lead to remote code execution.

The affected product is Veeam Backup and Replication. All installations of the Backup Server component are potentially impacted, as specific version information is not provided. The flaw requires the attacker to have domain credentials that allow them to connect to the Backup Server.

The CVSS score of 9.4 classifies this as Critical, indicating a severe threat. The EPSS score of 2% shows a low but nonzero likelihood of exploitation. The vulnerability is not presently listed in CISA KEV, implying no confirmed active exploitation at this time. The attack vector requires an authenticated domain user with access to the Backup Server, limiting exposure to users with domain credentials but remaining a high‑risk scenario due to the possibility of complete server compromise.