Veeam ONE CVE-2026-64631

Exploitation requires a valid Veeam ONE application account with at minimum low-privilege (viewer or read-only) access rights - anonymous or unauthenticated exploitation is not indicated by the PR:L CVSS metric. The application's web or API interface must be network-reachable from the attacker's position (AV:N). No special non-default configuration is required beyond possessing a legitimate session. Exploitation is not described as automatable (SSVC: Automatable: no), suggesting the injection point may require some manual interaction or chaining. Limiting factors: requires prior credential acquisition or insider access; no evidence of weaponized tooling or active exploitation.

The CVSS 4.0 base score of 8.6 (High) reflects meaningful risk, driven primarily by broad subsequent-system impact rather than direct damage to the Veeam ONE host itself (VC:H but VI:L/VA:N). Real-world risk is moderated by several factors: exploitation requires a valid application account (PR:L), SSVC marks exploitation as 'none' and automatable as 'no', and EPSS sits at only 0.27% (18th percentile). The SSVC 'Technical Impact: partial' rating is in mild tension with the CVSS 4.0 subsequent-system scores of H/H/H - defenders should treat the database content as the primary threat surface rather than the Veeam ONE service itself. No KEV listing and no reported POC suggest this has not been operationalized by threat actors as of the analysis date. The most realistic threat actor is an insider or a compromised low-privileged service account rather than an external unauthenticated attacker. That said, Veeam products are regularly targeted by ransomware operators seeking to compromise backup infrastructure; an authenticated foothold via phishing or credential stuffing converting to SQL injection data exfiltration is a plausible escalation path.

An attacker who has obtained a low-privileged Veeam ONE account - via phishing, credential stuffing, or an insider threat - sends a crafted HTTP request to an injectable Veeam ONE API or web endpoint with SQL metacharacters embedded in a query parameter. The unsanitized input is interpreted as SQL by the backend database engine, allowing the attacker to enumerate tables, exfiltrate stored credentials for managed backup targets, and potentially read infrastructure configuration data that enables lateral movement into protected backup environments. No public exploit code is known at time of analysis.