Which versions of Veeam ONE are affected by EUVD-2026-52760?

Veeam ONE backup monitoring systems are vulnerable to remote code execution by users with administrative credentials (CVE-2026-58074, CVSS 8.6).

How to fix or mitigate EUVD-2026-52760?

Within 24 hours: audit all Veeam ONE installations in your environment and document versions currently deployed; inventory all accounts with administrative-level access and restrict network connectivity to Veeam ONE monitoring interfaces to trusted administrative networks. Within 7 days: enforce multi-factor authentication on all high-privilege Veeam ONE service accounts; enable comprehensive audit logging for administrative activities and establish monitoring alerts for code-injection patterns; revoke or deprivilege any unnecessary high-privilege account access. Within 30 days: contact Veeam Support directly to confirm patch availability status and obtain a patch deployment timeline; evaluate and deploy any available intrusion detection signatures targeting CWE-94 code injection from Veeam or third-party vendors; conduct a full access review to remove abandoned administrative credentials.

Veeam ONE EUVD-2026-52760

Q: What is the CVSS score of EUVD-2026-52760?

EUVD-2026-52760 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58074 HIGH

Code Injection (CWE-94)

2026-08-04 hackerone

GHSA-m5vc-wv34-qp26

RCE Code Injection One

8.6

CVSS 4.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible endpoint exploitable by high-privileged authenticated users only; scope unchanged as impact is confined to the Veeam ONE host system.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 17:07 vuln.today

CVE Published

Aug 04, 2026 - 15:56 cve.org

HIGH 8.6

DescriptionCVE.org

A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

AnalysisAI

Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.

Technical ContextAI

CWE-94 (Improper Control of Generation of Code) identifies the root cause: Veeam ONE fails to properly sanitize or neutralize user-controlled input before incorporating it into a code generation or evaluation context, enabling injection of executable code into the server runtime. The affected product is identified by CPE cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:* - the wildcard version field indicates all releases of Veeam ONE are listed as potentially affected with no version bound specified. Veeam ONE is a monitoring, reporting, and analytics component of the Veeam Data Platform, deployed in enterprise environments to provide visibility over Veeam-managed backup and replication infrastructure. Its privileged position in backup architectures means a compromise can expose backup credentials, job configurations, and telemetry for the entire protected environment.

RemediationAI

Consult the Veeam security advisory at https://www.veeam.com/kb4892 for the official fix. A patched version number is not independently confirmed from available input data - the exact remediated release must be obtained directly from that advisory before planning upgrades. As compensating controls pending patching, restrict access to Veeam ONE's administrative and web interfaces to only explicitly authorized administrators using network-layer controls (firewall rules, VPN, or jump-host enforcement); this reduces the attacker surface but does not eliminate risk if a high-privileged account is already compromised. Audit and minimize the set of accounts holding high-privileged roles within Veeam ONE, rotating credentials for any account with recent unverified activity. Enable logging and alerting on unusual server-side execution events within the Veeam ONE host. Note that credential restriction alone does not address the underlying code injection flaw and patching remains the definitive remediation.