Veeam has announced urgent security patches for Veeam ONE version 13.1, addressing several vulnerabilities that pose significant security risks. These flaws could allow malicious actors to execute unauthorized code, access confidential files, and elevate user privileges.
Critical Vulnerability Details
Among the issues addressed, the vulnerability identified as CVE-2026-64633 stands out with a critical CVSS v4.0 score of 10.0. This flaw permits unauthenticated remote code execution on the Veeam ONE agent host, presenting a severe threat to affected systems.
The vulnerabilities impact Veeam ONE 13.0.2.6723 and earlier 13 series builds. It is imperative for organizations utilizing these versions to upgrade to Veeam ONE 13.1.0.7034, which resolves the vulnerabilities detailed in Veeam’s Knowledge Base article KB4892.
Additional High-Risk Vulnerabilities
Another significant issue, CVE-2026-58075, allows attackers to read arbitrary files without authentication. This could lead to unauthorized access to sensitive information such as configuration files and credentials. Additionally, CVE-2026-58074, which targets high-privileged users, enables arbitrary code execution on the Veeam ONE server, posing a risk of increased control for attackers.
Furthermore, the advisory addresses CVE-2026-64631, a SQL injection vulnerability that allows low-privileged users to extract database information, potentially aiding attackers in mapping valuable infrastructure details.
Mitigation and Response Measures
Veeam also patched CVE-2026-64634, a flaw that can be exploited for local privilege escalation within the Reporter service, and CVE-2026-64630, which allows unauthorized report access. The latter was reported as a medium-severity issue.
Several vulnerabilities were identified through HackerOne, while CVE-2026-58074 was discovered internally. Veeam cautions that attackers may reverse-engineer patches post-disclosure to target unpatched systems.
Recommendations for Organizations
Security teams are advised to verify all Veeam ONE version 13 deployments and ensure updates to version 13.1.0.7034 are applied promptly. It is essential to review server and agent exposure, limit access to trusted personnel, and monitor for unusual activity.
Organizations should remain vigilant in investigating anomalous database queries, unauthorized report access, or unexpected code execution events to safeguard against potential breaches.
Enhance your Security Operations Center by integrating threat detection tools and accelerating response strategies to address these vulnerabilities effectively.
