CVE-2026-58069: CWE-22 Path Traversal in Veeam Backup and Replication

This vulnerability (CVE-2026-58069) in Veeam Backup & Replication is a CWE-22 path traversal issue that permits an authenticated Cloud Connect tenant to read arbitrary files on the host system of the service provider. The flaw affects versions >=12 <=12.3.2 and >=13 <=13.0.3. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. The vulnerability does not affect integrity or availability and requires privileges of an authenticated tenant. No vendor patch information is provided in the input data.

An authenticated Cloud Connect tenant can exploit this vulnerability to read arbitrary files on the service provider host, potentially exposing sensitive or confidential information. This compromises the confidentiality of the host system but does not directly affect integrity or availability. The vulnerability requires tenant-level authentication, limiting exposure to authorized users with access to the Cloud Connect service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict tenant access and monitor for suspicious activity related to file access. Follow vendor guidance once available.