KB4858: List of Security Fixes and Improvements in Veeam ONE

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2026-107671A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification
• CVE-2026-65641A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account
• CVE-2026-64632A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account
• CVE-2026-58075A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally
• CVE-2026-64634A vulnerability allowing local privilege escalation to the Reporter service context
• CVE-2026-64633A vulnerability allowing remote unauthenticated code execution on the agent host
• CVE-2026-58074A vulnerability allowing a high-privileged user to execute arbitrary code on the server
• CVE-2026-64631A vulnerability allowing a low-privileged user to inject SQL and extract database contents
• CVE-2026-64630A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link

Source and provenance

Original title: KB4858: List of Security Fixes and Improvements in Veeam ONE. Captured 26 Oct 2026, 11:29 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.