NTLM Credential Capture by Low-privileged User in Veeam ONE

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

Cleartext Credential Logging in Support Logs

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

Unauthenticated File Disclosure with Potential Privilege Escalation in Veeam ONE

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

Unauthenticated privileged API access after admin session starts

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.

Veeam ONE Agent Remote Unauthenticated Code Execution

A vulnerability allowing remote unauthenticated code execution on the agent host.

Unauthenticated Memory Exhaustion Leading to Denial of Service in Veeam Service Provider Console

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.

Local Privilege Escalation via Reporter Service in Veeam ONE

A vulnerability allowing local privilege escalation to the Reporter service context.

SQL Injection Vulnerability in Veeam ONE Enables Low‑Privileged User Data Extraction

A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

Unauthenticated Impersonation in Veeam Service Provider Console Exposes Agent Credentials

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.

Out‑of‑scope Report Data Retrieval in Veeam ONE

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

High-Privilege Arbitrary Code Execution in Veeam ONE

A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.

Local Privilege Escalation via Veeam Updater Component

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.

Return URL Manipulation in Veeam Service Provider Console Enables Password Reset Token Theft

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Remote Code Execution in Veeam Service Provider Console via Command Injection

This vulnerability in Veeam Service Provider Console allows for remote code execution.

Local Privilege Escalation in Veeam Agent for Microsoft Windows

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Arbitrary File Write on Linux Veeam Backup Server via Authenticated Backup Administrator

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.