Summary
Ein Angreifer kann mehrere Schwachstellen in Veeam ONE ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen, SQL-Injektionen durchzuführen oder Berechtigungen zu erweitern.
Product
Veeam One ist eine Lösung für virtuelle Systeme, die diverse Monitoring- und Reporting-Funktionen bereitstellt.
Vulnerabilities 7
-
Critical 10.0CVE-2026-64633 Public exploit
A vulnerability allowing remote unauthenticated code execution on the agent host.
-
High 8.7
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further levera…
-
High 8.6
A vulnerability allowing a high-privileged user to execute arbitrary code on the server.
-
High 8.6
A vulnerability allowing a low-privileged user to inject SQL and extract database contents.
-
High 8.5
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
-
High 8.4
A vulnerability allowing local privilege escalation to the Reporter service context.
-
Medium 5.3
A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.
Revision history
-
#3
Referenz(en) aufgenommen: EUVD-2026-66765
-
#2
Neue Updates von Veeam aufgenommen
-
#1
Initiale Fassung
References
-
Veeam Support Knowledge Base vom 2026-08-04
https://www.veeam.com/kb4892
-
Veeam Support Knowledge Base vom 2026-08-25
https://www.veeam.com/kb4705