Veeam One
21 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-107671 | 13.1 – 13.1.0.7233 | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally bef | HIGH 8.5 | 0.3 % | ||
| CVE-2026-64632 | ≤ 13.0.2 | A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. | HIGH 8.5 | 0.4 % | ||
| CVE-2026-65641 | < 13.1 ; < 13.0.2 | A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-64634 | ≤ 13.0.2 | A vulnerability allowing local privilege escalation to the Reporter service context. | HIGH 8.4 | 0.2 % | ||
| CVE-2026-64633 | ≤ 13.0.2 | A vulnerability allowing remote unauthenticated code execution on the agent host. | CRITICAL 10.0 | 0.6 % | ||
| CVE-2026-64631 | ≤ 13.0.2 | A vulnerability allowing a low-privileged user to inject SQL and extract database contents. | HIGH 8.6 | 0.4 % | ||
| CVE-2026-64630 | ≤ 13.0.2 | A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link. | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-58075 | ≤ 13.0.2 | A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privil | HIGH 8.7 | 0.4 % | ||
| CVE-2026-58074 | ≤ 13.0.2 | A vulnerability allowing a high-privileged user to execute arbitrary code on the server. | HIGH 8.6 | 0.5 % | ||
| CVE-2024-42024 | 12.1 | A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on | CRITICAL 9.1 | 1.3 % | ||
| CVE-2024-42023 | 12.1 | An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. | HIGH 8.8 | 0.5 % | ||
| CVE-2024-42022 | 12.1 | An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. | HIGH 7.5 | 0.3 % | ||
| CVE-2024-42021 | 12.1 | An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. | HIGH 7.5 | 0.3 % | ||
| CVE-2024-42020 | 12.1 | A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. | HIGH 7.3 | 0.4 % | ||
| CVE-2024-42019 | 12.1 | A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user int | CRITICAL 9.0 | 0.5 % | ||
| CVE-2023-41723 | 11, 11a, 12 | A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of t | MEDIUM 4.3 | 12 % | ||
| CVE-2023-38549 | 11 ; 11a ; 12 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of | MEDIUM 5.4 | 19 % | ||
| CVE-2023-38548 | 12 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of | CRITICAL 9.8 | 12 % | ||
| CVE-2023-38547 | 11 ; 11a ; 12 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its | CRITICAL 9.9 | 19 % | ||
| CVE-2020-15419 | 10.0.0.750_20200415 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Aut | HIGH 7.5 | 60 % | ||
| CVE-2020-15418 | 10.0.0.750_20200415 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Aut | HIGH 7.5 | 9.4 % |