Veeam Backup & Replication CVE-2026-108141

Exploitation requires two specific, confirmed preconditions: (1) the attacker must be an authenticated user holding the Restore Operator role on the Veeam Backup & Replication server, and (2) the attacker must control the contents of a NAS share that is backed up by that server. These are the AT:P attack requirement and PR:H privilege level made concrete. Given those, relative path-traversal sequences in the controlled backup contents let the attacker write files to an arbitrary path on the backup server. Limiting factors: no public exploit is available, the Restore Operator role is a privileged, non-default position typically held by backup administrators, and the attacker additionally needs write influence over the backed-up NAS data - so realistic risk is largely confined to malicious insiders or attackers who have already compromised a privileged backup account or a NAS data source. Affected deployments are Backup and Replication 13.1 before 13.1.2 and 13.0 before 13.0.3.

This is a moderate-severity, hard-to-exploit integrity flaw rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, base 5.9) signals a network-reachable but high-complexity issue that requires high privileges plus a specific attack precondition (AT:P): the attacker must already hold the Restore Operator role AND control the contents of a backed-up NAS share. Impact is scoped to integrity (VI:H) with only limited availability impact (VA:L) and no confidentiality impact (VC:N), consistent with an arbitrary file write via path traversal (CWE-22). No CISA KEV listing and no EPSS score are present in the input, and no exploit or PoC reference is provided - only the HackerOne reporter credit - so there is no evidence of active or imminent exploitation. The vendor priority signal is 'this_month', which aligns with the picture of a credible but preconditioned flaw: a real patch-management priority for Veeam operators, not a high-CVSS-but-illusory issue, but gated behind privileged, insider-or-compromised-account access. Note the input provides no EPSS and no SSVC automatable/technical-impact breakdown beyond the vendor 'this_month' label - exploitation probability is therefore inferred from the vector, not measured.

An attacker who already holds the Restore Operator role on a Veeam Backup & Replication server, and who can control the contents of a NAS share that the server backs up, plants crafted files/paths containing relative path-traversal sequences. When those contents are processed, the traversal lets the attacker write attacker-controlled files to an arbitrary location on the backup server, potentially overwriting binaries or configuration to escalate control of the backup infrastructure. No public exploit identified at time of analysis; the trigger mechanism beyond 'relative path traversal during restore/backup handling' is not detailed in the available sources.