Critical Vulnerabilities in Veeam Software Expose Systems to Remote Attacks

On August 5, 2026, Veeam disclosed multiple critical vulnerabilities affecting Veeam ONE and Veeam Service Provider Console. The vulnerabilities include remote unauthenticated code execution, file read access, and SQL injection, with CVSS scores ranging from 8.4 to 10.0. Affected systems include Veeam ONE 13.1 and the Veeam Service Provider Console, which could allow attackers to execute arbitrary code, impersonate agents, and exhaust host memory. These vulnerabilities were reported through HackerOne and discovered during internal testing. Patches have been released to address these issues, and users are urged to update their systems immediately.

Key Points: • Multiple critical vulnerabilities in Veeam software allow remote code execution and credential theft. • CVSS scores range from 8.4 to 10.0, indicating high severity and potential for exploitation. • Users are advised to apply patches immediately to mitigate risks associated with these vulnerabilities.