Veeam ONE vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Veeam ONE: 8 record(s), with affected versions and fixes.
CVE-2026-65641
Critical · 9.3
CWE-288 Aug 26, 2026
Authentication Bypass Using an Alternate Path or Channel in Veeam ONE
A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.
CVE-2026-64632
High · 8.5
CWE-522 Aug 26, 2026
Insufficiently Protected Credentials in Veeam ONE
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
CVE-2026-64634
High · 8.4
CWE-269 Aug 4, 2026
Improper Privilege Management in Veeam ONE
A vulnerability allowing local privilege escalation to the Reporter service context.
CVE-2026-64633
Critical · 10.0
CWE-94 Aug 4, 2026
Code Injection in Veeam ONE
A vulnerability allowing remote unauthenticated code execution on the agent host.
CVE-2026-64631
High · 8.6
CWE-89 Aug 4, 2026
SQL Injection in Veeam ONE
A vulnerability allowing a low-privileged user to inject SQL and extract database contents.
CVE-2026-64630
Medium · 5.3
CWE-863 Aug 4, 2026
Incorrect Authorization in Veeam ONE
A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.
CVE-2026-58075
High · 8.7
CWE-287 Aug 4, 2026
Improper Authentication in Veeam ONE
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
CVE-2026-58074
High · 8.6
CWE-94 Aug 4, 2026
Code Injection in Veeam ONE
A vulnerability allowing a high-privileged user to execute arbitrary code on the server.