Veeam Enterprise Manager EUVD-2025-211040

Exploitation requires an authenticated Veeam Backup Enterprise Manager portal user (PR:L) to actively open an attacker-crafted link (UI:A) while their portal session is valid - the attacker cannot trigger the flaw autonomously. These two factors (valid portal authentication context for the victim plus a social-engineering step to get the victim to click) are the primary limiters on real-world risk. No special non-default product configuration is identified in the description as a prerequisite; the vulnerability lies in the Enterprise Manager web portal's handling of the crafted link.

This is a genuinely moderate, not high-priority, issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 4.8) is internally consistent with a classic CWE-79 cross-site scripting flaw: network-reachable but requiring both an authenticated portal user (PR:L) and active user interaction (UI:A) - the victim must open an attacker-crafted link. There is no direct confidentiality, integrity, or availability impact on the vulnerable system itself (VC/VI/VA all N); the impact is confined to the subsequent system (the victim's browser session), reflected as SC:L/SI:L. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no signal of active exploitation or available exploit code. The signals are aligned rather than conflicting: a medium-severity, interaction-and-authentication-dependent XSS with no evidence of exploitation. This is a routine patch-in-normal-cycle item, not an emergency, though Veeam's role as high-value backup infrastructure means a session-hijack of a privileged backup operator would be meaningful if chained.

An attacker crafts a malicious link containing a script payload targeting the Veeam Backup Enterprise Manager web portal and delivers it (e.g., via email or chat) to an authenticated portal user. When that user clicks the link while logged in, the script executes in their browser session in the context of the portal, potentially allowing session token theft, UI manipulation, or actions performed as that user. No public exploit code was identified in the provided data.