CVE-2026-93026: CWE-862 Missing Authorization in Veeam Backup and Replication

This vulnerability (CWE-862: Missing Authorization) in Veeam Backup & Replication permits a user with Backup Viewer privileges to modify critical security credentials such as the Enterprise Manager master key and stored antivirus update credentials. The flaw exists in versions >=12 and <12.3.2.4934. The CVSS 4.0 base score is 6.1, indicating medium severity, with network attack vector, low attack complexity, and partial privileges required. The vulnerability does not require user interaction and impacts confidentiality and integrity at a low level but has high impact on availability.

An attacker with Backup Viewer privileges can alter the Enterprise Manager master key and antivirus update credentials, potentially undermining the security of backup management and antivirus updates. This could lead to unauthorized changes in backup configurations or antivirus operations, affecting system integrity and availability. However, the attack requires some privileges and is not trivial to execute remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Backup Viewer privileges to trusted users only and monitor for unauthorized changes to critical credentials.