Senior Manager

Critical Veeam ONE flaw lets unauthenticated attackers execute code remotely. August 5, 2026 Veeam has issued security updates to address multiple vulnerabilities in Veeam ONE, including a critical flaw that could enable an unauthenticated remote attacker to execute arbitrary code on an affected agent host. Security Products & Services Discover more Cybersecurity certifications Dark web monitoring Hacking & Cracking This issue, identified as CVE-2026-64633, has received the highest CVSS v4.0 score of 10.0, indicating it is the most severe vulnerability addressed in the latest update. Organizations using Veeam ONE version 13.0.2.6723 or any earlier build of version 13 are advised to update immediately. Critical Veeam ONE flaw. The vulnerabilities have been resolved in Veeam ONE version 13.1.0.7034, which was released as part of version 13.1. Veeam documented these fixes in Knowledge Base article KB4892, published on July 29, 2026. The company cautioned that the disclosure of vulnerabilities and the availability of patches may motivate threat actors to reverse-engineer the fixes, potentially leading to the development of exploits targeting organizations that have not yet updated their Veeam environments. CVE-2026-64633 is particularly important because it does not require authentication for an attacker to attempt code execution on the agent host. A successful exploit could give an attacker a foothold in an environment that relies on Veeam ONE for monitoring, reporting, and visibility into backup infrastructure. Given the critical role that backup platforms play in ransomware recovery and incident response, security teams should prioritize remediation efforts. Discover more Incident response planning Threat intelligence reports Secure data storage In addition to the critical remote code execution issue, the update addresses five other high- and medium-severity vulnerabilities related to arbitrary file reading, local privilege escalation, SQL injection, arbitrary code execution by privileged users, and unauthorized access to report data. Several of these flaws were reported through HackerOne, while one was discovered during Veeam's internal security testing. Security Products & Services Vulnerabilities Resolved * CVE-2026-64633- Critical; CVSS v4.0: 10.0. Allows remote, unauthenticated code execution on the Veeam ONE agent host. Reported through HackerOne. * CVE-2026-58075- High; CVSS v4.0: 8.7. Allows an unauthenticated attacker to read arbitrary files from the host, potentially enabling local privilege escalation. Reported through HackerOne. * CVE-2026-58074-High; CVSS v4.0: 8.6. Allows a high-privileged user to execute arbitrary code on the Veeam ONE server. Discovered during internal testing. * CVE-2026-64631- High; CVSS v4.0: 8.6. Allows a low-privileged user to conduct SQL injection and extract database contents. Reported through HackerOne. * CVE-2026-64634- High; CVSS v4.0: 8.4. Allows local privilege escalation to the Veeam ONE Reporter service context. Reported through HackerOne. * CVE-2026-64630-Medium; CVSS v4.0: 5.3. Allows a low-privileged user to retrieve report information beyond the intended scope of a shared report link. Reported through HackerOne. Administrators should upgrade affected installations to Veeam ONE version 13.1.0.7034 immediately. Discover more Vulnerability assessment service Cybersecurity news platform Additionally, teams should review the exposure of Veeam ONE servers and agents, restrict unnecessary network access, monitor authentication and service activities for anomalies, and ensure that the backup management infrastructure is integrated into vulnerability management and incident response workflows. ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure. Anti-malware software Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world. Hot this week

Veeam unveils Data Cloud Vault Archive for enterprise. July 30, 2026 11:00 IST Veeam(R) Software, the Data and AI Trust Company, has announced the general availability of Veeam Data Cloud Vault Archive, a new archival-class cloud tier in the Veeam Data Cloud Vault family built for secure, compliant, long-term backup retention at archive-class economics. The new solution helps organizations move older, rarely used backup data off expensive storage while keeping it secure, compliant and recoverable. Trusted data must remain resilient, secure, private, compliant and recoverable for as long as the business needs it. As data volumes grow and regulatory requirements increase in an agentic AI world, organizations must retain and protect more data for longer periods - including aged, inactive and infrequently accessed backup data. Without a modern archive tier, many organizations store this data on premium storage systems designed for fast recovery, creating unnecessary cost and capacity pressure. Designed to complete the backup data lifecycle, Veeam Vault Archive provides a lower-cost archive tier for aged backups, large unstructured data sets, and redundant, obsolete or trivial (ROT) data. Recovery-critical backups should remain on performance-optimized Veeam Data Cloud Vault, while older backup data is moved into Veeam Vault Archive automatically, securely and without adding operational complexity. "Data powers organizations, and trusted AI requires trusted data," said Rehan Jalil, President of Products and Technology at Veeam. "That means data must be protected, isolated, recoverable and stored in the right location - even when it is no longer actively used. Long-term retention of that data has become a cyber resilience, compliance and cost challenge all at once. Veeam Data Cloud Vault Archive gives customers a secure, immutable, and cost-effective way to tier aging backups, cold and ROT data off premium storage while keeping a trusted copy on storage better fit for long-term retention." Backup archives are no longer passive storage - they are becoming a frontline cyber resilience and compliance asset, and a critical part of data and AI trust. Veeam research shows backup repositories are targeted in 96% of ransomware attacks, while 58% of organizations say data residency and sovereignty is the most important factor in deciding where data is stored. Veeam Vault Archive was built for this reality: immutable, logically air-gapped and encrypted archive storage with data placement control and predictable long-term retention economics. Retire the ROT: Stop Paying Premium Rates for Cold Data Veeam Vault Archive helps organizations move ROT data from premium storage to an archive tier built for secure long-term retention. Working with Veeam Data Platform v13.1, customers can tier older backups by policy, directly archive large unstructured data sets including NAS backups, and scan data to help verify clean restore points before long-term retention. With Veeam Vault Archive, organizations can: Retire ROT by moving redundant, obsolete, trivial, and other cold backup data off premium storage and into archive-class cloud storage. Strengthen security with immutable, encrypted and logically air-gapped archive storage. Support privacy through encryption and customer-controlled key management. Meet long-term compliance requirements with immutable retention, user-defined data placement and recoverability to alternate locations. Improve resilience by supporting Veeam's 3-2-1-1-0 rule with an immutable, logically air-gapped archive copy. Simplify governance through policy-based tiering from Veeam Data Cloud Vault to Veeam Vault Archive. Replace tape with a fully managed cloud archive that is secure by default and accessible on demand. Simplify data management and reduce costs by archiving large, unstructured data sets, including NAS backups, directly to Veeam Vault Archive. A Modern Alternative to Tape Tape has long been treated as the default answer for low-cost retention. But physical media introduces risk and friction - handling, transport, offsite logistics, delayed recovery and additional management overhead. Veeam Vault Archive gives organizations a cloud-based alternative to tape, delivering archive-class economics with the security and operational simplicity customers expect from Veeam. Archived backup data is immutable, encrypted and logically air-gapped, helping organizations maintain a trusted long-term copy without managing physical media. Available With Veeam Data Platform v13.1 Veeam Vault Archive arrives alongside Veeam Data Platform v13.1, including capabilities such as NAS Direct to Archive and expanded threat detection for NAS and cloud workloads. Together, these innovations help customers archive data they have validated as clean and maintain a trusted last line of defense for long-term recovery.

Veeam Software has launched Veeam Data Cloud Vault Archive, a new archival-class cloud tier designed for secure, compliant long-term backup retention at reduced costs. The solution helps organisations move older, infrequently accessed backup data off expensive storage systems whilst maintaining security and recoverability. The product addresses growing data volumes and regulatory requirements by providing a lower-cost archive tier for aged backups and redundant data. According to Veeam research, backup repositories are targeted in 96% of ransomware attacks, whilst 58% of organisations cite data residency as crucial when deciding storage locations. Veeam Vault Archive offers immutable, encrypted and logically air-gapped storage, serving as a cloud-based alternative to physical tape. The solution arrives alongside Veeam Data Platform v13.1 and is available through Veeam's global partner network.