Veeam ONE EUVD-2026-52756

No special conditions required for the initial file read - the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms unauthenticated exploitation requiring no user interaction and no elevated privileges, accessible over the network in what appears to be a default deployment. The attacker must have network connectivity to the Veeam ONE server's web interface or API port; organizations that expose Veeam ONE management interfaces to untrusted networks face direct exploitation risk without any prerequisite access. The secondary local privilege escalation step requires that the attacker either operate on the same host or extract credential material usable for local access - this second phase is local and dependent on what files are successfully read in the first phase. No non-default configuration flag, optional feature enablement, or specific platform dependency was identified in the provided data as a limiting prerequisite.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the attack characteristics: fully remote, zero-friction, unauthenticated exploitation with high confidentiality impact. This is not a case of inflated CVSS - the no-auth, low-complexity network vector corresponds directly to the description. EPSS data was not provided, so exploitation probability cannot be quantified; this gap is a notable confidence limitation. KEV status is absent from the provided intelligence, meaning CISA has not confirmed active exploitation at time of analysis. No POC is noted, but the simplicity of the attack primitive (authenticated bypass leading to file read) makes weaponization realistic and fast. The two-phase nature of the full attack chain - remote file read followed by local privilege escalation - means complete host compromise requires an additional local step; however, in backup management contexts, extracted credential material alone may be sufficient for lateral movement into connected backup repositories or managed infrastructure. Organizations running Veeam ONE with any internet or cross-segment exposure should treat this as high priority.

An unauthenticated remote attacker sends a crafted HTTP request to the Veeam ONE web interface that exploits the CWE-287 authentication bypass, triggering the server to return arbitrary host filesystem files in the response without validating session credentials. The attacker targets high-value files such as Veeam database connection strings, local credential caches, or configuration files containing service account passwords, then uses the extracted material to escalate privileges on the Veeam ONE host or pivot into connected backup infrastructure. No public POC has been confirmed at time of analysis, but the zero-authentication, low-complexity network vector makes exploit development straightforward.