Veeam ONE's CVSS 10.0 Unauthenticated RCE Targets the Box That Watches Your Backups
KB4892 patches six flaws in one release — including a maximum-severity bug that needs no credentials, no user interaction, and no attack requirements at all
On August 4, 2026, Veeam published KB4892 disclosing six vulnerabilities in Veeam ONE — the monitoring and reporting layer that sits across an organization's backup and virtualization estate. The worst of the six, CVE-2026-64633, scores a perfect 10.0 on CVSS v4.0: a remote, unauthenticated attacker can execute arbitrary code on the Veeam ONE agent host with zero prerequisites — no credentials, no user click, no special conditions. One release, 13.1.0.7034, closes all six.
Scores as of 2026-08-12live record →
Six bugs, one same-day patch
Veeam ONE 13.0.2.6723 and every earlier version-13 build are affected. Three of the six were reported through Veeam's HackerOne vulnerability disclosure program; one — CVE-2026-58074 — was caught internally during Veeam's own testing. All six carry CVSS v4.0 scores rather than v3, which is worth noting since v4.0 splits impact into "vulnerable system" and "subsequent system" metrics; CVE-2026-64633's 10.0 comes partly from that subsequent-system impact (SC:H/SI:H/SA:H), meaning the flaw doesn't just compromise the agent host itself, it's rated to reach beyond it.
| CVE | CVSS v4.0 | Severity | Access needed | What it does |
|---|---|---|---|---|
| CVE-2026-64633 | 10.0 | Critical | None (unauthenticated, network) | Remote code execution on the agent host |
| CVE-2026-58075 | 8.7 | High | None (unauthenticated, network) | Arbitrary file read from the host; chainable into local privilege escalation |
| CVE-2026-58074 | 8.6 | High | High-privileged account (network) | Arbitrary code execution on the server |
| CVE-2026-64631 | 8.6 | High | Low-privileged account (network) | SQL injection extracting full database contents |
| CVE-2026-64634 | 8.4 | High | High-privileged account (local) | Local privilege escalation to the Reporter service context |
| CVE-2026-64630 | 5.3 | Medium | Low-privileged account (network) | Retrieves report data outside an intended shared-link scope |
Why the agent host is the part to worry about
Veeam ONE isn't the backup engine — it's the dashboard that watches it: agents deployed across the estate report status, capacity, jobs and alerts back to a central server. That means the Veeam ONE agent is, by design, network-reachable across the infrastructure it monitors and holds credentials and configuration data useful for reconnaissance. CVE-2026-64633's own CVSS v4.0 vector — AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — reads as: network-reachable, low complexity, no attack requirements, no privileges, no user interaction, and complete confidentiality/integrity/availability impact on both the vulnerable system and whatever it touches next.
A plausible path from CVE-2026-64633 to backup-layer impact
- Attacker on the network
- CVE-2026-64633: unauthenticated RCE on Veeam ONE agent
- Code execution as the agent process
- Read monitoring config, stored credentials, infra topology
- Pivot toward backup/virtualization management plane
- Disable or tamper with backups before encryption
Why "no exploit yet" isn't the same as "safe"
Veeam's own advisory warns that attackers will likely reverse-engineer the 13.1.0.7034 patch to find and exploit unpatched deployments — a routine n-day pattern once a fix ships. Veeam's flagship product, Backup & Replication, has lived through exactly this cycle four times, and CISA has added all four to its Known Exploited Vulnerabilities catalog.
| Label | Value |
|---|---|
| CVE-2026-64633 (Veeam ONE, new) | 0.00337 |
| CVE-2022-26501 (VBR, KEV) | 0.04104 |
| CVE-2022-26500 (VBR, KEV) | 0.05828 |
| CVE-2023-27532 (VBR, KEV) | 0.7761 |
| CVE-2024-40711 (VBR, KEV) | 0.90369 |
How fast Veeam's past critical bugs went from patch to ransomware
- CVE-2023-27532 patchedCredential-exposure flaw in Veeam Backup & Replication, CVSS 7.5
- First exploitation observedFIN7-linked activity began targeting unpatched instances within weeks
- Added to CISA KEVFollowed reports of Cuba ransomware exploiting the same flaw
- CVE-2024-40711 patchedUnauthenticated deserialization RCE in Veeam Backup & Replication, CVSS 9.8
- Technical writeup publishedwatchTowr Labs delayed release to give admins a patching window
- Akira and Fog ransomware exploitationBoth gangs used the flaw for initial access ahead of encryption
Veeam ONE today vs. the historical Veeam pattern
- Patched same-day across all 6 issues in one release
- No workaround published — upgrade is the only fix
- No public PoC, Metasploit module, or Nuclei template
- No confirmed exploitation reported by Veeam or press
- Patch-to-first-exploitation gap: as little as ~3-5 weeks
- Ransomware crews (FIN7, Cuba, Akira, Fog) moved in once PoC/analysis existed
- CISA added all 4 comparable critical/high VBR bugs to KEV
- Backup infrastructure was targeted specifically to block recovery
What to do now
- Inventory every Veeam ONE v13 deployment (server + agents) and confirm the exact build number.
- Upgrade to Veeam ONE 13.1.0.7034 — the single release that resolves all six CVEs. There is no partial-patch or config-only mitigation.
- Until upgraded, restrict network access to Veeam ONE agents and the server to trusted administrative segments only — CVE-2026-64633 and CVE-2026-58075 both require nothing more than network reachability.
- After upgrading, review logs for unusual database queries, unexpected report/shared-link access, or unexplained process execution on Veeam ONE hosts predating the patch.
- Treat this the same way you'd treat any backup-adjacent critical bug: patch on urgency, not on the normal maintenance calendar.
| Component | Affected | Fixed |
|---|---|---|
| Veeam ONE (all editions) | 13.0.2.6723 and earlier v13 builds | 13.1.0.7034 |
Exploitation status current as of 2026-08-12live record →