Veeam ONE EUVD-2026-52759

Exploitation requires a valid Veeam ONE user account with at least low-level authenticated access (PR:L confirmed by CVSS vector). The vulnerable functionality is specifically the shared report link feature - the incorrect authorization flaw is triggered when a low-privileged user accesses or manipulates a shared report link to query data outside its intended scope. Unauthenticated external attackers cannot exploit this flaw directly without first obtaining valid credentials. Limiting factors: the attacker must hold a legitimate account within the Veeam ONE deployment; impact is confined to read-only access of report data and does not extend to backup infrastructure modification, credential theft, or code execution. Deployments that do not use the shared report link feature, or that restrict all Veeam ONE access to fully trusted administrators only, reduce practical exposure.

The CVSS 4.0 score of 5.3 (medium) is consistent with a bounded confidentiality-only flaw requiring authentication. The vector confirms network reachability (AV:N), trivial complexity (AC:L), no special attack preconditions (AT:N), and low-privilege authentication (PR:L) - meaning any valid Veeam ONE account holder can attempt exploitation. Impact is scoped exclusively to subsequent-system confidentiality (SC:L), with no integrity or availability consequences, which limits the blast radius to information disclosure of backup infrastructure report data. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is present and no public POC has been identified, suggesting this is not being actively weaponized at scale. The primary real-world risk is an insider or low-privileged IT operator gaining unauthorized visibility into backup job status, protected systems inventories, or infrastructure topology across organizational scopes they should not access - information useful for planning further attacks. This is a genuine priority for organizations using Veeam ONE's report-sharing feature, but does not represent an emergency patch-now scenario absent confirmed exploitation.

A low-privileged Veeam ONE user - such as a helpdesk operator or read-only monitoring account holder - obtains a shared report link (either legitimately or via phishing) and crafts a modified API or web request that references report data outside the scope authorized by that link. The attacker successfully retrieves backup infrastructure report data from other organizational units or environments, gaining visibility into protected system inventories, backup job states, or infrastructure topology they are not authorized to see. No public POC currently exists, but the low complexity of the authorization bypass makes independent discovery straightforward for a motivated insider.