Veeam has released security updates for Veeam ONE 13.1 to address multiple vulnerabilities that could permit attackers to execute code, access sensitive files, steal database data, and escalate privileges This article explores veeam released security. . The highest severity issue, identified as CVE-2026-64633, has been assigned a critical CVSS score of 10.0 due to its capability to remotely exploit unauthenticated code execution on the Veeam ONE agent host.
A successful exploit could give attackers a foothold in the targeted environment, potentially allowing them to deploy malware, move laterally within the network, steal credentials, or carry out ransomware attacks. This could expose sensitive information such as infrastructure details, backup data, user accounts, and operational records, making it easier for attackers to map the environment and identify high-value systems.
CVE IDs: Unauthenticated RCE - Critical; Arbitrary File Read - High; Privileged Code Execution - High; SQL Injection - High; Local Privilege Escalation - High; Unauthorized Report Access - Medium. Security teams should identify all Veeam ONE version 13 deployments, confirm whether they are running builds earlier than 13.1.0.7034 (the earliest update available), and apply the available update as soon as possible. Organizations should also review Veeam ONE server and agent exposure, restrict access to trusted administrators, monitor for suspicious activity, and investigate unusual database queries, access patterns, or code execution events.
Integrate ANY.RUN with your SOC now.
