EUVD-2026-52756
GHSA-v52p-jj97-4668
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable file read with no user interaction required; no integrity or availability impact from the file read primitive itself, scope unchanged.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
AnalysisAI
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Technical ContextAI
Veeam ONE is an enterprise monitoring, reporting, and analytics platform for Veeam backup and replication environments, exposing web-based dashboards and APIs that aggregate infrastructure telemetry. The CPE string cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:* applies to all versions without a lower bound, indicating broad version exposure. The root cause is CWE-287 (Improper Authentication), which covers cases where an application fails to adequately verify the identity of an actor before granting access to a resource - here, the resource is arbitrary files on the host filesystem. This class of flaw in backup software is especially severe because Veeam ONE hosts or has access to configuration files containing credentials, encryption keys, and database connection strings used to manage backup infrastructure across the enterprise. The tags 'Authentication Bypass' and 'One' from HackerOne further confirm the bypass nature of the flaw rather than a post-auth path traversal.
RemediationAI
Apply the vendor-issued patch referenced in Veeam KB4892 at https://www.veeam.com/kb4892; the knowledge base article should specify the exact patched version - verify that target version from the advisory before upgrading, as no fixed version number was independently confirmed in the provided data. As an immediate compensating control pending patching, restrict network access to Veeam ONE's web interface and API endpoints (typically accessible via configured HTTPS ports and the dedicated Veeam ONE monitoring port) using host-based firewall rules or network segmentation so that only trusted management workstations can reach the service; this eliminates the unauthenticated remote attack vector but does not protect against insider or compromised-host scenarios. Additionally, audit files accessible on the Veeam ONE host - particularly configuration files, database connection strings, and credential stores - to assess data-at-risk and determine whether exploitation may have already occurred. If Veeam ONE cannot be immediately patched or network-restricted, consider temporarily disabling internet-facing exposure and alerting on unexpected access patterns to the web interface.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on t
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ON
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to per
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remo
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remot
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privi
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the n
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticate
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today