🚨Critical - Veeam ONE Unauthenticated Remote Code Execution (CVE-2026-64633) A code-injection flaw in Veeam ONE (versions up to and including 13.0.2) allows remote, unauthenticated code execution on the monitoring agent host. Veeam ONE is the monitoring and reporting component of the Veeam Data Platform, and its agents run on many monitored hosts, so the exposed surface is broad. This one requires no authentication and no user interaction, scores the maximum CVSS 4.0 of 10.0, and is scope-changing with full CIA impact - the most severe of the August Veeam advisory batch (alongside the authenticated variant CVE-2026-58074). 👉Apply the Veeam ONE fix per Veeam KB4892 as a priority.
Post summary
A critical remote code execution flaw (CVE-2026-64633) in Veeam ONE is disclosed with a recommended fix via Veeam KB4892.