Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641
Veeam Software has issued updates for its backup environment monitoring tool Veeam ONE to resolve multiple security vulnerabilities, including issues rated as critical.
The company published a security advisory on 25 August 2026 detailing the fixes for the 13.x branch. Among the addressed flaws is CVE-2026-65641, which permits a service account to perform SMB authentication. This vulnerability received a CVSSv4.0 base score of 9.3 and is rated Critical.
The fixes are delivered in Veeam ONE 13.1 Patch 0 (13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (13.0.2.7159). The latter release also incorporates vulnerabilities previously corrected in 13.1.0.7034, including CVE-2026-64633 that carries a maximum CVSS score of 10.0.
Veeam initially reported six vulnerabilities resolved in 13.1.0.7034 but later added CVE-2026-64632, bringing the total to seven. All seven issues are now included in the 13.0.2 Patch 1 release.
For users remaining on the 12.x branch, the company released Veeam ONE 12.3 Patch 1 (12.3.0.7165). This update backports fixes for CVE-2026-58074, CVE-2026-64631, and CVE-2026-64632 that were originally addressed in the 13.1.0.7034 release.
Related articles
Three Critical Vulnerabilities in Adobe Campaign Classic Allow Arbitrary Code Execution
Adobe has disclosed three severe vulnerabilities in Adobe Campaign Classic that could permit attackers to execute arbitrary code on affected systems. The issues affect both Windows and Linux versions and include two OS command injection flaws along with one server-side request forgery vulnerability. Each vulnerability received the maximum CVSSv3.1 base score of 10.0 and is rated Critical. Adobe released fixes in version 7.4.4 build 9401, which must be applied to on-premises components in both pure on-premises and hybrid environments. Although no active exploitation has been observed, Adobe assigned the highest priority level and recommends applying the update within 72 hours.
Dirty COW CVE-2016-5195: How a 2016 Linux Kernel Race Condition Still Enables Privilege Escalation in Embedded Systems
The 2016 Linux kernel vulnerability CVE-2016-5195, known as Dirty COW, allowed local users to bypass copy-on-write protections and modify read-only memory mappings through a race condition involving writes to /proc/self/mem and madvise calls. Although patched in supported distributions years ago, the flaw persists in older kernels running on routers, cameras, and industrial controllers that receive infrequent firmware updates. Public exploits often target /etc/passwd or SUID binaries for root access, but success depends heavily on the presence of login mechanisms, BusyBox applets, and suitable binaries in the target environment. When standard targets are absent, attackers may pivot to overwriting vDSO functions in process memory to inject code executed by higher-privileged processes. The article explains why ready-made PoCs frequently fail on minimal BusyBox-based systems and outlines the checks required for architecture, ABI, vDSO symbols, and payload compatibility. It also references the practical exercise Strange And Dirty on the free White Hacker course for hands-on adaptation of the exploit chain.
Critical Authentication Bypass Vulnerability Found in OAuth2 Proxy, No Patch Released
A severe authentication bypass vulnerability has been identified in the OAuth2 Proxy authentication proxy, tracked as CVE-2026-76835. The issue allows attackers to circumvent authentication by sending crafted X-Forwarded-Uri headers when the trusted_proxy_ip setting is not configured. This affects default reverse proxy configurations and enables unauthorized access to protected paths. Although version 7.15.2 addressed a related flaw under CVE-2026-40575, the vulnerability persists in standard reverse proxy setups. VulnCheck rated the flaw with a CVSS v4.0 base score of 9.3, classifying it as Critical. No patched release is currently available despite ongoing work in the source repository.
Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, known in the bug hunting community as n1, shares his decade-long experience at Positive Technologies leading a team focused on software security analysis. The team specializes in discovering new zero-day vulnerabilities while also reproducing known 1-day issues to support penetration testing engagements. Klyuchnikov is also a member of the PT SWARM team, which regularly publishes technical articles, tips, and timely vulnerability breakdowns. With extensive participation in international bug bounty platforms and the Russian Standoff Bug Bounty program, he aims to explain the practical role of 1-day vulnerabilities for newcomers entering bug bounty hunting. The article provides foundational knowledge on how security researchers leverage publicly disclosed vulnerabilities in real-world testing scenarios.