Veeam ONE CVE-2026-58074

Exploitation requires possession of a high-privileged authenticated account within Veeam ONE, as confirmed by the PR:H metric in the CVSS 4.0 vector. The attack is delivered over the network (AV:N) with low complexity (AC:L), no specific attack requirements (AT:N), and no user interaction required (UI:N). No special non-default configuration or deployment mode is specified in the available description beyond the high-privilege authentication prerequisite. Exploitation is bounded to the Veeam ONE application and its host system (SC:N/SI:N/SA:N), with no lateral scope change to adjacent systems described. The primary limiting factor for defenders is the high-privilege requirement: accounts with standard or read-only roles cannot trigger this flaw. Securing and auditing administrative accounts in Veeam ONE is therefore the most impactful interim control.

The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability of the vulnerable system, with a low-complexity network attack vector requiring no user interaction - but critically gated behind PR:H (high privileges required). The real-world attacker population is therefore narrowed to those already holding administrative credentials in Veeam ONE, which significantly reduces opportunistic exploitation risk compared to unauthenticated flaws. No EPSS score, CISA KEV listing, or known public POC was present in the input data, making quantitative exploitation likelihood assessment impossible at this time. However, in post-compromise or insider threat scenarios, or where admin credentials are reused or phished, this vulnerability becomes a high-severity lateral movement and persistence path. The all-version CPE wildcard is a concern: without a confirmed minimum or maximum version bound, all production deployments of Veeam ONE must be treated as potentially affected until vendor clarification. The absence of scope change metrics (SC:N/SI:N/SA:N) suggests impact stays within the Veeam ONE host boundary, but given Veeam ONE's integration with backup infrastructure, indirect downstream impact on connected systems should not be dismissed.

An attacker who has obtained high-privileged Veeam ONE credentials - whether through phishing, credential stuffing, lateral movement from another compromised host, or insider access - submits a crafted network request to a Veeam ONE server endpoint that passes unsanitized input into a code evaluation context. The server executes the injected code with its own process privileges, granting the attacker arbitrary command execution on the Veeam ONE host. From this position, the attacker can extract stored backup credentials, manipulate backup job configurations, or use the server as a pivot point into the broader data center environment.