Multiple Veeam ONE Vulnerabilities Allows Code Execution Attacks

Veeam has released security updates for Veeam ONE 13.1 to fix multiple vulnerabilities that could allow attackers to execute code, access sensitive files, steal database data, and escalate privileges. The most severe issue, tracked as CVE-2026-64633, has received a critical CVSS v4.0 score of 10.0 because it allows remote, unauthenticated code execution on the Veeam ONE agent host. The vulnerabilities affects Veeam ONE 13.0.2.6723 and all earlier version 13 builds. Organizations using affected deployments should update immediately to Veeam ONE 13.1.0.7034, the version that resolves all issues listed in Veeam Knowledge Base article KB4892. CVE-2026-64633 is the most dangerous flaw in the advisory. It could allow a remote attacker...

Read the full article at the source.