Veeam ONE: a severity 10.0 flaw allows executing code without authentication
Veeam has published an urgent security update for Veeam ONE, its monitoring, analytics and reporting platform for backup environments. The patch, included in version 13.1.0.7034, fixes six vulnerabilities, including a critical flaw with the maximum possible score on the CVSS v4.0 scale, a 10.0, which allows a remote attacker to execute code on the agent hosts without needing credentials. The advisory, reported by various incident response centres and specialised media, affects all versions of the 13 branch up to 13.0.2.6723.
The most serious hole: remote code execution without credentials
The main flaw, registered as CVE-2026-64633, is a remote code execution vulnerability that requires no authentication. An attacker with network access to the host where the Veeam ONE agent runs could send manipulated requests and manage to execute arbitrary code on that machine. The score of 10.0 out of 10 places it on the highest rung of severity: it’s a scenario in which exploitation is remote, needs no credentials or user interaction and can completely compromise the affected system.
The practical consequences of successful exploitation are the usual ones in this kind of flaw: malware deployment, credential theft, lateral movement across the network and, in the worst case, the triggering of ransomware campaigns. Monitoring agents, precisely because they’re installed on servers that manage backups, are an especially attractive target for attack groups.
Six vulnerabilities, a single update
In addition to the critical flaw, the Veeam advisory, documented in article KB4892, includes another five vulnerabilities of high and medium severity:
CVE-2026-58075: arbitrary file read (8.7)
It allows an unauthenticated attacker to read arbitrary files from the host, such as configurations, credentials or logs. Veeam notes it can also be used as support to escalate privileges locally.
CVE-2026-58074: code execution on the server (8.6)
It affects users with elevated privileges and allows executing arbitrary code on the Veeam ONE server. Although it requires prior access, an attacker who has already compromised a privileged account could extend their control over the platform.
CVE-2026-64631: SQL injection (8.6)
A SQL injection exploitable by a user with low privileges that allows extracting the database’s content: infrastructure details, backup information, account data and operational logs. Valuable material for mapping the environment and identifying the most sensitive systems.
CVE-2026-64634: local privilege escalation (8.4)
It allows elevating privileges up to the context of the Reporter service, the component in charge of generating the platform’s reports.
CVE-2026-64630: access to report data (5.3)
Of medium severity, it makes it possible for a user with few privileges to access report data outside the intended scope through a shared report link.
Why a backup monitoring platform matters
Veeam ONE is the console that accompanies Veeam Backup & Replication, one of the most widely used backup solutions in companies and public administrations. Its function is to watch over the health of backups, alert on incidents and generate reports about the data infrastructure. A compromise of this tool not only exposes sensitive information about the design of the corporate network, but can facilitate ransomware attacks: knowing where the backups are and how they’re managed is the first step to encrypting or destroying them before demanding the ransom.
It isn’t a theoretical scenario. In the past, flaws in Veeam products have been actively exploited by ransomware groups barely weeks after their disclosure, which turns any advisory from this manufacturer into a patching priority for security teams.
What organisations should do
The recommendation from Veeam and the security centres is clear: update as soon as possible to version 13.1.0.7034, which resolves all the described vulnerabilities. Before applying the patch, it’s worth identifying all the Veeam ONE deployments in the organisation and checking which ones run 13.0.2.6723 or an earlier build.
For installations that can’t be updated immediately, experts recommend restricting access to the Veeam ONE components to authorised users and checking that the network services aren’t exposed to untrusted access. Segmentation and configuration hardening are useful containment measures, but they don’t replace the patch, especially in the face of a flaw that allows executing code without credentials.
Conclusion
The combination of a CVSS score of 10.0, remote access without authentication and the strategic role of Veeam ONE in the backup infrastructure turns this advisory into one of the most urgent security updates of the moment. Patching is quick and cheap; recovering a compromised data infrastructure, much less so.
