Critical Vulnerabilities Discovered in Veeam Backup & Replication and Veeam ONE

www.veeam.com

Critical Vulnerabilities Discovered in Veeam Backup & Replication and Veeam ONE

First seen 28 Oct 2026, 14:08 UTC •72.8

Article Content

1 / 3

Browse articles

ThreatCluster •October 28, 2026 at 16:11 UTC

•CVE-2026-4948 allows unauthenticated access to Veeam Backup & Replication.
•CVE-2026-4951 enables bypassing of multi-factor authentication for Veeam ONE.
•Both vulnerabilities have been patched in the latest software builds.

Two critical vulnerabilities have been identified in Veeam software products. The first, CVE-2026-4948, allows unauthenticated attackers to bypass authorization on the CDP Coordinator Service, affecting Veeam Backup & Replication versions 13.1.1.18 and earlier, with a CVSS score of 9.1. The second, CVE-2026-4951, permits attackers with valid Administrator credentials to disable multi-factor authentication globally, impacting Veeam ONE versions 13.1.0.7233 and earlier, with a CVSS score of 8.5. Both vulnerabilities were reported through HackerOne and have been patched in newer software builds. Users are urged to update to the latest versions to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-28

Veeam vulnerabilities disclosed

Veeam announced two critical vulnerabilities affecting Backup & Replication and ONE products, urging users to update.

2026-10-28

Patches released

Veeam released patches for the vulnerabilities in Backup & Replication and ONE, addressing the critical issues.

More articles in this cluster (2)

Threat Graph

7 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Zero-day Exploit

Weakness (3)

CWE-22 - Path Traversal
CWE-269 - Improper Privilege Management
CWE-287 - Improper Authentication

Affected Platform (2)

Veeam
Windows

Relationships

Data Breach targets Veeam
Data Breach targets Windows
Zero-day Exploit targets Veeam
Zero-day Exploit targets Windows
Data Breach related to CWE-22 - Path Traversal
Data Breach related to CWE-269 - Improper Privilege Management
Data Breach related to CWE-287 - Improper Authentication

Common questions

What versions of Veeam are affected?

Veeam Backup & Replication versions 13.1.1.18 and earlier, and Veeam ONE versions 13.1.0.7233 and earlier are affected.

What is the severity of these vulnerabilities?

CVE-2026-4948 is rated critical with a CVSS score of 9.1, while CVE-2026-4951 is rated high with a score of 8.5.

How can I protect my systems?

Update to Veeam Backup & Replication 13.1.2 or 13.0.3, and Veeam ONE 13.1 P1 to mitigate these vulnerabilities.

Continue Reading

China-linked Hackers Exploit PHP2Shell to Compromise 25 Firewalls A China-linked threat actor has exploited vulnerabilities in PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Fragnesia privilege escalation bug (CVE-2026-46300) to gain root access to 25 firewalls, including those in an U.S. The attackers identified vulnerable systems using the FOFA search engine and executed…

Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…