Veeam Backup & Replication EUVD-2026-66762

Exploitation requires an existing local presence on the guest OS with read permissions on the Veeam support log file (AV:L, PR:L per CVSS 4.0). The vulnerability manifests specifically when Veeam Backup & Replication performs guest OS processing operations that generate credential-containing log entries - the log must have been written before exploitation is possible. No network-level access, special attack prerequisites, or elevated privileges are required beyond log-read access. Exploitation is bounded to the local guest context and is not remotely triggerable. The primary limiting factors are the requirement for a pre-existing guest OS foothold and that the log file must exist and be readable at the time of the attack.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 6.8 Medium, reflecting a local attack vector requiring low-privilege access with no complexity or special conditions. The high confidentiality impact is disproportionately significant for a medium-severity score because Veeam backup service accounts frequently hold domain-administrator-equivalent privileges - credential recovery therefore enables substantial privilege escalation well beyond the initial local foothold. EPSS data was not supplied in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public exploit code exist at time of analysis, consistent with a post-compromise rather than initial-access risk profile. The primary threat actor is an insider or an attacker who has already established limited local presence on a guest and uses harvested backup credentials to move laterally or escalate. The CPE wildcard version field indicates no version is currently confirmed safe, so the exposure scope across Veeam deployments is broad.

An attacker who has gained a limited local foothold on a guest OS - through phishing, a separate vulnerability, or insider access - locates the Veeam support log path and reads it without elevated privileges. The log contains cleartext backup processing credentials for a privileged service account, which the attacker extracts and uses to authenticate as a high-privilege backup operator, potentially achieving domain administrator access across the environment.