Veeam ONE vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20234
3. 20246
4. 20269

Newest CVEs

• CVE-2026-107671

  A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA…

  Veeam · ONE

  High8.5
• CVE-2026-64632

  A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

  Veeam · ONE

  High8.5
• CVE-2026-65641

  A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

  Veeam · One

  Critical9.3
• CVE-2026-58074

  A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

  Veeam · ONE

  High8.6
• CVE-2026-64630

  A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

  Veeam · ONE

  Medium5.3
• CVE-2026-64631

  A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

  Veeam · ONE

  High8.6
• CVE-2026-58075

  A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

  Veeam · ONE

  High8.7
• CVE-2026-64633

  A vulnerability allowing remote unauthenticated code execution on the agent host.

  Veeam · ONE

  Critical10.0
• CVE-2026-64634

  A vulnerability allowing local privilege escalation to the Reporter service context.

  Veeam · ONE

  High8.4
• CVE-2024-42021

  An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.

  Veeam · One

  High7.5