This vulnerability (CVE-2026-32997) affects Veeam Backup and Replication version 13 running on Linux. It involves an absolute path traversal flaw (CWE-36) that permits an authenticated Backup Administrator to write arbitrary files to the system. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned by HackerOne but currently lacks an official remediation level or patch. The product is not a cloud service, so remediation depends on vendor updates to the software.

An attacker with Backup Administrator privileges can exploit this vulnerability to write arbitrary files on the Linux server hosting Veeam Backup and Replication. This could lead to unauthorized modification or replacement of critical files, potentially compromising system integrity and availability. The high CVSS score indicates significant risk if exploited. However, exploitation requires authenticated access with elevated privileges, limiting the attack surface. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, organizations should monitor Veeam's advisories closely for updates. In the meantime, restrict Backup Administrator role assignments to trusted personnel only and consider additional monitoring of file system changes on the Linux server to detect potential exploitation attempts.