CVE-2026-58069

CVE-2026-58069 is a path-traversal flaw (CWE-22) in Veeam Backup & Replication that lets an already authenticated Cloud Connect tenant read arbitrary files on the service provider's host. It is triggered remotely over the network with low privileges and no user interaction; the CVSS 4.0 score is 8.3, with high confidentiality impact on the vulnerable system and on subsequent systems and no integrity or availability impact. An attacker who is a Cloud Connect tenant can expose files on the provider host, which may include other customers' backup data or secrets stored on that server, but the advisory does not describe code execution or file modification. Affected deployments are Veeam service-provider hosts offering Cloud Connect; specific version ranges are not stated in the data. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Service providers running Veeam Cloud Connect should apply the vendor's security update for Backup & Replication as soon as it is available and confirm the build against Veeam's advisory, since no fixed version is listed in this data. Until then, restrict which tenants can use Cloud Connect, limit network access to the provider host, and review logs for unexpected file-read or path-traversal activity from tenant accounts. Treat backup repositories and other tenant data on the provider host as potentially exposed and rotate any credentials or secrets stored in readable files if misuse is suspected.