EUVD-2026-94227
GHSA-66c3-wq53-j995
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-privilege Backup Viewer over the network (PR:L, AV:N); AC:H reflects the 4.0 AT:P precondition; integrity-dominant (I:H) with minor C/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
AnalysisAI
Authenticated Backup Viewer accounts in Veeam Backup & Replication can modify the Enterprise Manager master key and stored antivirus-update credentials due to missing authorization (CWE-862), affecting deployments with Enterprise Manager and that low-privilege role. The issue is medium severity (CVSS 4.0 score 6.1) and requires valid Backup Viewer credentials plus an additional attack precondition, so it is not anonymous or unauthenticated exploitation; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker who is already authenticated to Veeam Backup & Replication / Enterprise Manager holding the low-privilege Backup Viewer role (PR:L) - it is not exploitable by anonymous remote attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity authorization flaw (CWE-862, Missing Authorization) in Veeam Backup & Replication, scored CVSS 4.0 6.1 by the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix documented in Veeam KB4934 (https://www.veeam.com/KB4934); the provided input does not include an exact fixed version, so validate the applicable patched build for the deployed Veeam Backup & Replication/Enterprise Manager release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Backup And Replication
View allLocal privilege escalation in Veeam Agent for Microsoft Windows enables a low-privileged authenticated user to escalate
Remote code execution in Veeam Backup & Replication enables an authenticated domain user to execute arbitrary code on th
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a de
Arbitrary file write in Veeam Backup & Replication 13 (≤13.0.1) on Linux-based deployments allows an authenticated Backu
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host thr
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account cr
Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows l
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today