← News
/DISPATCH · 2026-08-06

Veeam ONE Hits CVSS 10.0 Unauthenticated RCE; Backup Infra Again a Ransomware Pivot

Veeam disclosed six Veeam ONE flaws. CVE-2026-64633 scores CVSS v4.0 10.0, letting a remote unauthenticated attacker execute arbitrary code on the agent host. Same-day Veeam Service Provider Console 9.3 CVE-2026-58073 scores 9.5 and can steal managed agent credentials. Upgrade now.

Veeam published KB4892 on 5 August 2026, disclosing six high-severity vulnerabilities in the Veeam ONE monitoring and reporting component. Most severe: CVE-2026-64633, CVSS v4.0 base 10.0, allowing a remote unauthenticated attacker to execute arbitrary code on the Veeam ONE agent host. Same-day Veeam Service Provider Console 9.3 advisory: CVE-2026-58073 at 9.5, exploitable to steal managed agent credentials. No workarounds. Upgrade is the only fix. Affected: Veeam ONE 13.0.2.6723 and earlier 13.x; Veeam Service Provider Console 9.2.1.33875 and earlier 9.x.

Incident Overview

Veeam ONE is the presentation-layer component in Veeam backup and monitoring, widely deployed in enterprise backup infrastructure and tightly coupled with Veeam Backup & Replication and Service Provider Console. It handles performance monitoring, reporting, License billing, compliance audit, and alert correlation. Compromise lets attackers tamper with backup jobs, delete historical snapshots, and pivot via alert channels into the Backup & Replication primary node, destroying recoverability. Veeam warns: after patch publication, attackers typically reverse the patch within days and hit unpatched deployments.

Technical Details

CVE-2026-64633: CVSS 10.0 Unauthenticated Remote Code Execution

CVE-2026-58075: Unauthenticated Arbitrary File Read (CVSS 8.7)

Also unauthenticated. Attacker can read arbitrary files on the ONE host, chainable to local privilege escalation—typical targets include `web.config`, `appsettings.json`, Windows DPAPI master keys, and service account credential caches.

CVE-2026-58074: Privileged User Arbitrary Code Execution (CVSS 8.6)

Privileged-user execution chain found by Veeam internal testing, commonly used for lateral movement. With a ONE admin account, attacker can execute arbitrary commands on the ONE server. Combined with CVE-2026-58075: read file → steal credentials → escalate → command execution, full takeover.

CVE-2026-64631: Low-Privilege SQL Injection (CVSS 8.6)

Low-privilege ONE users can inject SQL and extract the full database. ONE DB holds backup topology, VM inventory, Licensing, and alert policy—high-value intel for follow-on intrusion.

CVE-2026-64634: Local Privilege Escalation (CVSS 8.4)

Local user can elevate to the ONE Reporter service account context. In multi-user setups, often chained with the RCE above to reach system administrator.

CVE-2026-64630: Shared Report Unauthorized Read (CVSS 5.3)

Low-privilege users can read report data beyond shared-link authorization. Common in cross-tenant MSP deployments.

Impact Assessment

From an attacker view, Veeam ONE is the coordination hub of the backup chain. Compromise lets attackers: delete alerts, disable backup verification, alter License—so ransomware cleanup proceeds without alarms. Coupling with Veeam Service Provider Console turns MSP cases into large-scale downstream customer infections. That is why the score is 10.0.

Veeam and independent researchers note: given this product's history as an initial foothold for ransomware groups, public PoC or in-the-wild exploit is expected within days. For MSPs, service providers, and orgs exposing ONE on untrusted networks, the 72-hour window is a hard deadline.

Remediation

References