Multiple Critical Vulnerabilities in Veeam ONE Expose Systems to Code Execution and Data Theft
Veeam ONE 13.1 addresses critical vulnerabilities including unauthenticated remote code execution on agent hosts, arbitrary file reads, and SQL injection.
Veeam has issued urgent security updates for its Veeam ONE monitoring software, addressing a suite of critical vulnerabilities that could allow attackers to execute arbitrary code, steal sensitive data, and escalate privileges within affected environments. The most severe flaw, CVE-2026-64633, carries a CVSS v4.0 score of 10.0 and enables unauthenticated remote code execution on Veeam ONE agent hosts. This critical vulnerability could provide threat actors with an initial foothold, paving the way for malware deployment, lateral movement, credential harvesting, or ransomware attacks.
The vulnerabilities impact Veeam ONE versions 13.0.2.6723 and all earlier builds within the 13.0 series. Veeam strongly recommends that all organizations running affected deployments immediately update to Veeam ONE version 13.1.0.7034, which resolves all identified issues detailed in Veeam Knowledge Base article KB4892.
Beyond the critical RCE flaw, several other high-severity vulnerabilities have been patched. CVE-2026-58075 allows unauthenticated attackers to read arbitrary files from the host system, potentially exposing configuration files, credentials, or logs, and could also be leveraged for privilege escalation. Another high-severity issue, CVE-2026-58074, permits arbitrary code execution on the Veeam ONE server itself, though exploitation requires elevated access, making it a potent tool for insiders or attackers who have already compromised privileged accounts.
Further complicating the security posture of unpatched systems, CVE-2026-64631 introduces an SQL injection vulnerability. This flaw could allow low-privileged users to extract sensitive database contents, including infrastructure details, backup information, and operational records, aiding attackers in reconnaissance and target identification. Additionally, CVE-2026-64634 enables local privilege escalation to the Reporter service context, granting an attacker with local access elevated permissions.
Veeam also addressed CVE-2026-64630, a medium-severity vulnerability that permits unauthorized access to report data, and noted that several of these vulnerabilities were reported by the security community via HackerOne, while CVE-2026-58074 was discovered internally.
The vendor emphasized that attackers frequently reverse-engineer patches to identify and exploit unpatched systems. Consequently, security teams must proactively identify all Veeam ONE version 13 deployments, verify their build numbers, and apply the necessary updates without delay.
In addition to patching, organizations are advised to review the network exposure of their Veeam ONE servers and agents, restrict access to trusted administrators, and implement robust monitoring for suspicious activities. This includes watching for unusual database queries, unauthorized report access, or signs of code execution, which could indicate a compromise.
The timely patching of these vulnerabilities is crucial for protecting critical backup infrastructure and sensitive data from a range of sophisticated cyber threats.