Critical Veeam ONE Vulnerabilities Let Attackers Execute Code

Key Takeaways

• Veeam has released urgent security updates for Veeam ONE 13.1 to address multiple critical and high-severity vulnerabilities.
• The most critical flaw, CVE-2026-64633, allows unauthenticated remote code execution (RCE) on Veeam ONE agent hosts.
• Affected versions include Veeam ONE 13.0.2.6723 and all earlier 13 builds.
• Organizations must update immediately to Veeam ONE 13.1.0.7034 to mitigate these risks.

Veeam has issued critical security updates for its Veeam ONE 13.1 platform, addressing a suite of vulnerabilities that could enable attackers to execute arbitrary code, access sensitive files, exfiltrate database information, and escalate privileges within compromised environments. These patches are crucial for all organizations utilizing the affected software.

Among the disclosed flaws, CVE-2026-64633 stands out with a critical CVSS v4.0 score of 10.0. This vulnerability permits remote, unauthenticated code execution on the Veeam ONE agent host, posing a significant risk to data integrity and system control.

The vulnerabilities impact Veeam ONE 13.0.2.6723 and all prior builds of version 13. A prompt upgrade to Veeam ONE 13.1.0.7034 is required to resolve all issues detailed in the official Veeam advisory (KB4892).

Exploitation of CVE-2026-64633 could provide threat actors with an initial foothold, potentially leading to the deployment of malware, lateral movement across networks, credential theft, or the execution of ransomware attacks.

Multiple Veeam ONE Vulnerabilities Addressed

Beyond the critical RCE, several other high-severity vulnerabilities have been patched:

Arbitrary File Read and Privilege Escalation

CVE-2026-58075, a high-severity flaw, allows an unauthenticated attacker to read arbitrary files from the host system. This capability could be leveraged to gain access to critical configuration files, stored credentials, system logs, or other sensitive data. Veeam notes that this vulnerability could also facilitate local privilege escalation.

Another high-severity issue, CVE-2026-58074, enables arbitrary code execution on the Veeam ONE server, specifically targeting high-privileged users. While requiring elevated access, this vulnerability could be exploited by an insider threat or an attacker who has already compromised a privileged account to expand control over the server infrastructure.

SQL Injection and Data Exposure

The Veeam advisory (KB4892) also addresses CVE-2026-64631, an SQL injection vulnerability. This flaw permits low-privileged users to extract the full contents of the database. Such a breach could expose sensitive infrastructure details, backup configurations, account data, and operational records, providing attackers with valuable intelligence for further attacks.

Local Privilege Escalation

CVE-2026-64634 allows for local privilege escalation to the context of the Reporter service. An attacker with local access could exploit this to gain elevated permissions, accessing functions and data otherwise restricted to that service.

Veeam also mitigated CVE-2026-64630, a medium-severity vulnerability that permits low-privileged users to retrieve report data beyond the intended scope of a shared report link, potentially exposing unauthorized information.

Several of these vulnerabilities were reported through the HackerOne platform, while CVE-2026-58074 was identified during Veeam’s internal security testing. Veeam emphasizes that attackers frequently reverse-engineer patches following public disclosures to identify and exploit unpatched systems.

What You Should Do

• Immediately identify all Veeam ONE version 13 deployments within your environment.
• Verify if any installations are running builds earlier than 13.1.0.7034.
• Apply the available update to Veeam ONE 13.1.0.7034 as soon as possible.
• Review and restrict Veeam ONE server and agent exposure, ensuring access is limited to trusted administrators.
• Implement continuous monitoring for suspicious activity, including unusual database queries, unauthorized report access, or unexpected code execution events.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.