One

NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.

Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.

Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.

SQL injection in Veeam ONE versions through 13.0.2 enables a low-privileged authenticated attacker to extract the full contents of the application database over the network. Veeam ONE occupies the monitoring and analytics management plane of Veeam's backup ecosystem, meaning its database likely holds infrastructure credentials, backup job configurations, and managed-system inventory - data whose exposure can propagate harm well beyond the application itself, reflected in the CVSS 4.0 subsequent-system impact ratings of SC:H/SI:H/SA:H. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity and the product's privileged position in enterprise backup environments elevate real-world priority.

Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.

Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.

Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.

Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Denial of service via out-of-range operator-code lookup in Samsung ONE machine learning framework prior to version 1.30.0 allows local attackers with user interaction to crash the model loading process. Missing bounds validation during operator code indexing permits access to invalid memory locations, triggering application termination without authentication.

Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Insufficiently Protected Credentials vulnerability could allow attackers to obtain user credentials due to weak protection mechanisms.

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.