Veeam Backup & Replication CVE-2026-32997

Attacker must possess valid credentials for an account assigned the Backup Administrator role on a Linux-based Veeam Backup & Replication 13 server at version ≤13.0.1; network reachability to the management interface is required but no user interaction is needed. Limiting factors: the Backup Administrator role is a privileged application role (PR:H) typically held by a small set of operators, Windows-based deployments are not in scope per the description, and versions outside the 13.x branch through 13.0.1 are not listed as affected in EUVD data.

Signals are mixed. CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) confirms network-reachable, low-complexity exploitation with no user interaction and high triad impact, but the PR:H requirement means an attacker must already hold Backup Administrator credentials - a privileged application role. KEV status is not asserted and no POC is referenced, so exploitation is theoretical at this point; EPSS is not provided in the input. Scope/subsequent system impact metrics are all N, suggesting the blast radius is constrained to the Veeam server itself rather than cascading to managed infrastructure. Realistic priority is high for organizations that treat backup infrastructure as crown-jewel assets (ransomware actors routinely target backup admins), but the PR:H gate makes this a credential-theft/lateral-movement amplifier rather than a pre-auth internet-facing emergency. The 'Information Disclosure' tag is inconsistent with a CWE-36 arbitrary file write primitive - verify the tag with vendor reporting.

An attacker who has phished or otherwise stolen Backup Administrator credentials authenticates to the Linux-based Veeam Backup & Replication 13 console over the network and invokes the affected operation with a crafted absolute path, writing a file such as a cron job, SSH authorized_keys entry, or shared-object preload into a system location. On the next scheduled execution or service restart, the planted file runs and the attacker gains code execution on the backup server, enabling them to disable or tamper with backup jobs ahead of a ransomware event. No public exploit identified at time of analysis.