Veeam ONE CVE-2026-64633

No special conditions - remote unauthenticated code execution against network-reachable Veeam ONE agent hosts, per CVSS AV:N/AC:L/AT:N/PR:N/UI:N. The only practical limiting factor is network reachability: the attacker must be able to reach the Veeam ONE agent/monitoring endpoint, so deployments that isolate Veeam ONE on a segmented management network significantly reduce exposure. No authentication, no user interaction, and no non-default configuration are required based on the supplied vector.

This is a genuine top-priority issue rather than a high-score-but-low-impact case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and full high impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), yielding the maximum 10.0. Because Veeam ONE monitors backup and virtualization infrastructure, code execution here provides a pivot into the wider environment, amplifying real-world consequence. Signal gaps to note explicitly: no EPSS score, KEV status, SSVC decision, or POC evidence was provided, so exploitation is currently 'no public exploit identified' - active exploitation is NOT confirmed and should not be assumed. Only a CVSS 4.0 vector was supplied (no 3.1), and no exact fix version accompanied the KB reference, so patch specifics require vendor verification.

An attacker with network access to the Veeam ONE agent host sends a crafted request to the vulnerable communication endpoint, injecting code that the server evaluates and executes without any credentials or user interaction. Given the low attack complexity, a single request can yield code execution as the service account, providing a foothold to pivot into the monitored backup and virtualization infrastructure. No public exploit has been identified at time of analysis.