Executive brief
Veeam ONE is a monitoring and management platform for virtualized environments. A local privilege escalation vulnerability allows an attacker with low-level access to escalate their privileges to the Reporter service context, potentially enabling unauthorized access to sensitive monitoring data and system configuration. This could compromise the security posture of the entire virtualized infrastructure under management.
Technical details
CVE-2026-64634 is a local privilege escalation vulnerability in Veeam ONE that allows a low-privileged local user to escalate privileges to the Reporter service account context. The vulnerability is related to improper access controls or insecure service configuration. Exploitation requires local system access but no additional authentication or user interaction. Successful exploitation grants an attacker the privileges of the Reporter service account, potentially enabling read/write access to monitoring databases and service credentials. Patches are available in Veeam ONE 13.1.0.7034, 13.0.2 Patch 1 (build 13.0.2.7159), and 12.3 Patch 1 (build 12.3.0.7165).
Affected products
- Veeam ONE 13.0.2.6723 and earlier 13.x builds; 12.3.0.4670 and earlier 12.x builds
Timeline
- 2026-08-04: disclosed
- 2026-08-04: patched: Veeam ONE 13.1.0.7034, Veeam ONE 13.0.2 Patch 1, Veeam ONE 12.3 Patch 1