The vulnerability permits an unauthenticated attacker to read any files from the Veeam ONE host, enabling the attacker to view sensitive configuration data and potential credentials. Once arbitrary files are accessible, the attacker may use that information to elevate privileges locally, potentially taking full control of the system. This flaw is classified as an authentication bypass (CWE‑287) and can lead to confidentiality loss and internal privilege escalation.

The vulnerability affects Veeam, specifically the Veeam ONE product. No specific version numbers are listed in the advisory, so all current installations may be at risk until an official patch is released.

The CVSS score of 8.7 indicates a high severity rating, with unauthenticated access providing the initial foothold. The EPSS score is not provided, but the lack of KEV listing suggests limited public exploitation to date. The likely attack vector is remote network access to the Veeam ONE service; however, any authenticated session can exploit the flaw if the authentication mechanism is bypassed. Given the high severity and potential for local privilege escalation, the vulnerability represents a significant risk to affected environments.