CVE-2026-58070: CWE-532 Insertion of Sensitive Information into Log File in Veeam Backup and Replication

This vulnerability involves the insertion of sensitive information (guest OS processing credentials) into a log file in cleartext within Veeam Backup and Replication. An attacker with read access to the support log on the guest system can extract privileged credentials. The CVSS 4.0 vector indicates local attack vector with low attack complexity and no user interaction required, but privileges are required to access the log. There is no known remediation level or patch available at this time.

Exposure of privileged account credentials in cleartext logs can lead to unauthorized access if an attacker or unauthorized user gains read access to the support log on the guest OS. This compromises confidentiality of sensitive credentials and could facilitate privilege escalation or lateral movement within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to guest OS support logs to trusted users only to prevent credential disclosure.