This flaw permits a Backup Viewer to alter the Enterprise Manager master key and the stored antivirus update credentials. By modifying the master key, an attacker can decrypt or tamper with protected backups, and by changing antivirus credentials, they can inject malicious antivirus updates or compromise related services. The weakness arises from missing authorization controls. The potential consequences include loss of backup integrity, unauthorized data disclosure, and the possibility of further compromise of the environment.

Veeam Backup and Replication, a product from Veeam. The affected versions are not specified in the available data, so all installations of the product are presumed affected until the vendor releases a fix.

The CVSS score of 6.1 indicates a moderate severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user with the Backup Viewer role in Enterprise Manager, suggesting an internal or privileged-credential attack. Because the attacker can change critical cryptographic keys and credentials, the risk of complete backup compromise is significant, especially in environments lacking strict role separation.