EUVD-2026-52754
GHSA-837p-qhrp-qm63
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack path with high-privilege prerequisite; no scope change since impact is contained to the vulnerable system; all three CIA metrics high given full service context takeover.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability allowing local privilege escalation to the Reporter service context.
AnalysisAI
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Veeam ONE (CPE: cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*) is a Windows-based monitoring, reporting, and analytics platform for Veeam backup infrastructure. The Reporter service is a distinct component responsible for generating backup reports and analytics, typically running under its own Windows service account. The root cause is CWE-269 (Improper Privilege Management), which arises when software fails to correctly assign, validate, or enforce privilege boundaries during transitions between security contexts. In practice, this class of flaw commonly manifests as insecure service binary permissions, unsafe deserialization of privileged objects, inadequate ACLs on service-accessible resources, or unguarded inter-process communication channels that allow a caller to impersonate or inject into the service context. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H) confirms local-only exploitation with no special attack requirements beyond high-privilege access.
RemediationAI
Apply the vendor-supplied patch documented in the Veeam knowledge base article at https://www.veeam.com/kb4892; the exact fixed version number must be confirmed from that advisory, as it was not available in the source data. As compensating controls while patching is pending, restrict local interactive and remote desktop access to Veeam ONE servers to only the minimum set of authorized administrators, thereby reducing the pool of accounts that satisfy the PR:H prerequisite. Audit the Reporter service account using the principle of least privilege - remove any permissions not strictly required for its function - so that successful escalation yields minimal additional access. Enable Windows event logging and auditing for service context changes and anomalous process creation under the Reporter service account to detect exploitation attempts. Note that none of these mitigations eliminate the underlying vulnerability; patching from the vendor advisory remains the definitive fix.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on t
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ON
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to per
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remo
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remot
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiri
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privi
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the n
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today