EUVD-2026-52757
GHSA-vxx2-mqjq-7x48
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-privilege SQL injection with scope change; high downstream C/I from database exfiltration; no direct availability impact on vulnerable system.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability allowing a low-privileged user to inject SQL and extract database contents.
AnalysisAI
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Technical ContextAI
Veeam ONE is an enterprise monitoring, reporting, and analytics platform for Veeam backup-and-replication infrastructure, identified by CPE cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), meaning user-controlled input is concatenated directly into SQL queries rather than being handled through parameterized statements or prepared queries. The network-accessible attack vector (AV:N) indicates the injectable endpoint is exposed over the application's standard web or API interface, and the low-privilege requirement (PR:L) confirms any authenticated application account - including read-only or viewer-role accounts - is sufficient to trigger the injection. The high subsequent-system impact in the CVSS 4.0 vector (SC:H/SI:H/SA:H) implies the application database has significant reach into dependent systems, consistent with Veeam ONE's role as an infrastructure orchestrator with stored credentials and configuration state for managed backup environments.
RemediationAI
Apply the fix documented in Veeam KB4892 at https://www.veeam.com/kb4892. A specific remediated version number is not confirmed in the available input data - consult the KB article directly for the target build. As a compensating control while patching, restrict Veeam ONE application access to the minimum set of accounts that require it and audit all low-privileged accounts for necessity, since any valid session can trigger the injection. Network-level controls (firewall rules limiting access to the Veeam ONE web interface to trusted IP ranges) reduce the exposure window but do not address the underlying injection flaw. Review audit logs for anomalous query patterns or unusual data exports from the Veeam ONE console as an indicator of prior exploitation.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on t
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ON
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to per
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remo
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remot
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiri
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privi
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticate
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today