Loading story…
Veeam disclosed multiple vulnerabilities affecting Veeam ONE and Veeam Service Provider Console, including flaws that can lead to remote code execution, authentication bypass, arbitrary file access, SQL injection, privilege escalation, and denial of service. In Veeam ONE, tracked issues include unauthenticated agent-host RCE (CVE-2026-64633), arbitrary file read that could aid local privilege escalation (CVE-2026-58075), SQL injection by a low-privileged user (CVE-2026-64631), server-side arbitrary code execution by a high-privileged user (CVE-2026-58074), and local privilege escalation to the Reporter service context (CVE-2026-64634). Vendor references point to advisory KB4892 for remediation guidance.
Veeam Service Provider Console versions earlier than 9.3 are also affected by several high-severity issues, including arbitrary file write leading to management-server RCE (CVE-2026-58072), authentication bypass allowing access to a proxied appliance API as Portal Administrator (CVE-2026-58071), impersonation of a managed agent to obtain credentials (CVE-2026-58073), and an unauthenticated denial-of-service flaw that can exhaust host memory (CVE-2026-58067). The Canadian Centre for Cyber Security warned that affected deployments should review Veeam guidance and apply updates, citing KB4892 for Veeam ONE and KB4893 for Service Provider Console; its notice lists affected versions as Veeam ONE up to 13.1.0.7034 and Service Provider Console prior to 9.3.0.35057.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-777 warning that Veeam ONE and Veeam Service Provider Console are affected by vulnerabilities. The notice directed users and administrators to review Veeam guidance and apply updates, referencing KB4892 and KB4893.
On August 4, 2026, the CVE records for the disclosed Veeam ONE and Veeam Service Provider Console flaws were updated with CISA Coordinator SSVC assessments. Across the entries, exploitation was recorded as none, with automatable and technical-impact values varying by vulnerability.
A new CVE entry documented a local privilege escalation vulnerability in Veeam ONE 13.0.2 and earlier. The flaw allows escalation to the Reporter service context and is classified as CWE-269.
A new CVE entry documented a remote unauthenticated code execution vulnerability in Veeam ONE up to and including version 13.0.2. The issue is classified as CWE-94 and affects the agent host.
A new CVE entry documented a SQL injection vulnerability in Veeam ONE through version 13.0.2. The flaw allows a low-privileged user to extract database contents.
A new CVE entry documented an unauthenticated arbitrary file read vulnerability in Veeam ONE versions up to and including 13.0.2. The disclosure notes the access can be leveraged further for local privilege escalation.
A new CVE entry documented a Veeam ONE flaw affecting versions up to and including 13.0.2. The issue allows a high-privileged user to execute arbitrary code on the server and is classified as CWE-94.
A new CVE entry documented an authentication weakness in Veeam Service Provider Console versions earlier than 9.3. The flaw allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials.
A new CVE entry documented an arbitrary file write vulnerability in Veeam Service Provider Console versions earlier than 9.3. The flaw affects the management server and can lead to remote code execution.
A new CVE entry documented an authentication bypass in Veeam Service Provider Console versions earlier than 9.3. The flaw allows unauthenticated access to the proxied appliance API as Portal Administrator during a short window after an administrator session begins.
A new CVE entry documented an unauthenticated denial-of-service flaw in Veeam Service Provider Console versions earlier than 9.3 that can exhaust host memory. The issue is classified as CWE-789.
Veeam published advisory KB4892 covering vulnerabilities resolved in Veeam ONE 13.1. The related disclosures describe affected Veeam ONE versions up to and including 13.0.2, while the Cyber Centre summarizes affected builds as prior to or equal to 13.1.0.7034.
Veeam published advisory KB4893 covering vulnerabilities resolved in Veeam Service Provider Console 9.3. The advisory indicates affected versions are earlier than 9.3, with the Cyber Centre later specifying versions prior to 9.3.0.35057.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
btcirt.bt
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veeam released security updates for multiple products after disclosing several vulnerabilities that affect enterprise backup and monitoring environments, including **Veeam Backup & Replication**, **Veeam ONE**, and **Veeam Service Provider Console**. The most severe issue, **`CVE-2026-32998`**, is a critical remote code execution flaw in Veeam Service Provider Console with a **CVSS score of 9.4**; Veeam said it is fixed in **version `9.2.1.33875`**. Canadian Centre for Cyber Security advisory **AV26-513** said affected versions include Veeam Backup & Replication 13 releases before **`13.0.2.29`**, Veeam ONE releases before **`13.0.2.6723`**, and Veeam Service Provider Console 9.2 releases before **`9.2.1.33875`**, and urged administrators to apply the vendor updates. Veeam also patched **`CVE-2026-32996`**, a high-severity local privilege escalation flaw in **Veeam Agent for Microsoft Windows** that could let a low-privileged local user gain administrative control, and **`CVE-2026-32997`**, an arbitrary file write issue affecting Linux-based backup servers running the **Veeam Software Appliance** that could allow an authenticated backup administrator to modify system files. For organizations unable to patch immediately, Veeam provided a workaround for the Service Provider Console bug by disabling the `AlarmManagement_ScriptExecution` setting in the local configuration JSON file, while older reporting on **Veeam ONE** underscores the continued security focus on Veeam’s management stack.
Jun 29, 2026
Veeam released security updates for **Veeam Service Provider Console (VSPC)** to fix two vulnerabilities tracked as `CVE-2024-42448` and `CVE-2024-42449`. The most severe issue, `CVE-2024-42448`, carries a **CVSS 9.9** rating and can allow a remote authenticated attacker with access to VSPC management agents to execute code on VSPC servers. The second flaw, `CVE-2024-42449`, is rated **CVSS 7.1** and can be exploited to obtain the **NTLM hash** of the VSPC server service account and delete files on the server. Affected releases include **VSPC 7.0.x, 8.0.x, and 8.1.x** versions earlier than **8.1.0.21999**. Exploitation requires the attacker to have authorization over abused agents on the targeted VSPC server, and Veeam has directed customers to upgrade impacted systems to **version 8.1.0.21999** to remediate the issues.
Jul 24, 2026
Veeam released security updates for multiple products, led by a **critical authentication bypass** in **Veeam Backup Enterprise Manager** tracked as `CVE-2024-29849`. The flaw allows an unauthenticated attacker to log in as any user, including an administrator, by supplying a forged VMware SSO token to the REST API service on TCP port `9398`. Veeam also addressed related Enterprise Manager issues including `CVE-2024-29850`, which can enable account takeover through **NTLM relay**, `CVE-2024-29851`, which can expose the NTLM hash of the Enterprise Manager service account, and `CVE-2024-29852`. The updates extend beyond Enterprise Manager. Veeam patched **Backup & Replication**, **Veeam Agent for Windows**, and **Veeam Service Provider Console**, including `CVE-2024-29212`, a critical remote code execution flaw in Service Provider Console, and `CVE-2024-29853`, a local privilege escalation issue in Agent for Windows. Veeam advised organizations to upgrade immediately, including moving Backup & Replication to at least **12.1.2.172** and Veeam Agent for Windows to at least **6.1.2**; where Enterprise Manager cannot be patched promptly, the company recommended stopping the Backup Enterprise Manager service as a temporary mitigation.
Aug 1, 2026