High
Veritas Backup Exec includes an OpenSSL component that specifies an OPENSSLDIR variable as /usr/local/ssl/. On the Windows platform, this path is interpreted as C:\usr\local\ssl. Backup Exec contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.
Privilege escalation
Veritas
Update to the latest version.
Refer to vendor advisory for the complete list of affected products and their respective patches.
https://www.veritas.com/content/support/en_US/security/VTS20-010