Critical Veeam ONE Flaw Lets Unauthenticated Attackers Execute Code Remotely

Veeam has issued security updates to address multiple vulnerabilities in Veeam ONE, including a critical flaw that could enable an unauthenticated remote attacker to execute arbitrary code on an affected agent host.

This issue, identified as CVE-2026-64633, has received the highest CVSS v4.0 score of 10.0, indicating it is the most severe vulnerability addressed in the latest update. Organizations using Veeam ONE version 13.0.2.6723 or any earlier build of version 13 are advised to update immediately.

Critical Veeam ONE Flaw

The vulnerabilities have been resolved in Veeam ONE version 13.1.0.7034, which was released as part of version 13.1. Veeam documented these fixes in Knowledge Base article KB4892, published on July 29, 2026.

The company cautioned that the disclosure of vulnerabilities and the availability of patches may motivate threat actors to reverse-engineer the fixes, potentially leading to the development of exploits targeting organizations that have not yet updated their Veeam environments.

CVE-2026-64633 is particularly important because it does not require authentication for an attacker to attempt code execution on the agent host.

A successful exploit could give an attacker a foothold in an environment that relies on Veeam ONE for monitoring, reporting, and visibility into backup infrastructure.

Given the critical role that backup platforms play in ransomware recovery and incident response, security teams should prioritize remediation efforts.

In addition to the critical remote code execution issue, the update addresses five other high- and medium-severity vulnerabilities related to arbitrary file reading, local privilege escalation, SQL injection, arbitrary code execution by privileged users, and unauthorized access to report data.

Several of these flaws were reported through HackerOne, while one was discovered during Veeam’s internal security testing.

Vulnerabilities Resolved

• CVE-2026-64633- Critical; CVSS v4.0: 10.0. Allows remote, unauthenticated code execution on the Veeam ONE agent host. Reported through HackerOne.
• CVE-2026-58075- High; CVSS v4.0: 8.7. Allows an unauthenticated attacker to read arbitrary files from the host, potentially enabling local privilege escalation. Reported through HackerOne.
• CVE-2026-58074-High; CVSS v4.0: 8.6. Allows a high-privileged user to execute arbitrary code on the Veeam ONE server. Discovered during internal testing.
• CVE-2026-64631- High; CVSS v4.0: 8.6. Allows a low-privileged user to conduct SQL injection and extract database contents. Reported through HackerOne.
• CVE-2026-64634- High; CVSS v4.0: 8.4. Allows local privilege escalation to the Veeam ONE Reporter service context. Reported through HackerOne.
• CVE-2026-64630-Medium; CVSS v4.0: 5.3. Allows a low-privileged user to retrieve report information beyond the intended scope of a shared report link. Reported through HackerOne.

Administrators should upgrade affected installations to Veeam ONE version 13.1.0.7034 immediately.

Additionally, teams should review the exposure of Veeam ONE servers and agents, restrict unnecessary network access, monitor authentication and service activities for anomalies, and ensure that the backup management infrastructure is integrated into vulnerability management and incident response workflows.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world