Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641
Veeam Software has issued updates for its backup environment monitoring tool Veeam ONE to resolve multiple security vulnerabilities, including issues rated as critical.
The company published a security advisory on 25 August 2026 detailing the fixes for the 13.x branch. Among the addressed flaws is CVE-2026-65641, which permits a service account to perform SMB authentication. This vulnerability received a CVSSv4.0 base score of 9.3 and is rated Critical.
The fixes are delivered in Veeam ONE 13.1 Patch 0 (13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (13.0.2.7159). The latter release also incorporates vulnerabilities previously corrected in 13.1.0.7034, including CVE-2026-64633 that carries a maximum CVSS score of 10.0.
Veeam initially reported six vulnerabilities resolved in 13.1.0.7034 but later added CVE-2026-64632, bringing the total to seven. All seven issues are now included in the 13.0.2 Patch 1 release.
For users remaining on the 12.x branch, the company released Veeam ONE 12.3 Patch 1 (12.3.0.7165). This update backports fixes for CVE-2026-58074, CVE-2026-64631, and CVE-2026-64632 that were originally addressed in the 13.1.0.7034 release.
Related articles
Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History
Researchers at ExPatch identified a vulnerability in Telegram Desktop that enabled attackers to embed malicious JavaScript into exported HTML chat histories without user detection. The flaw stemmed from insufficient sanitization of button captions added by bots, allowing hidden scripts to execute when the HTML file was opened in a browser. Malicious messages could be forwarded into chats and remain dormant until export, potentially exfiltrating messages, sender names, and timestamps to attacker servers. The issue affected versions 4.15.1 through 6.9.3, with fixes released in beta 6.9.4 and stable version 7.0.1 on July 14. No in-the-wild exploitation was observed, though the attack required specific conditions including an unpatched export and JavaScript-enabled browser. Users are advised to re-export chats after updating or open old files with JavaScript disabled.
Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT disclosed three vulnerabilities in MikroTik routers, two of which have been actively exploited since at least September 2. The flaws, rated 9.2 on CVSS, affect devices with internet-facing SSH access and were discovered using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol followed by manual verification. CVE-2026-67276 allows authentication bypass when the attacker knows the username and public key module, while CVE-2026-86060 permits privilege escalation via usernames containing invalid characters. Their combination enables full device compromise. A third issue, CVE-2026-67277 rated 8.8, resides in the speed-test service and can cause denial of service. Patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and MikroTik added detection for prior compromise. Attacks began concurrently with patch release and leave distinctive log entries.
Yookassa Webhook Flaw Allowed Forging Payment Confirmations via Single Curl Request
A technical audit of a car rental service uncovered a critical flaw in the Yookassa webhook handler where payment.succeeded events were trusted without verification. The endpoint accepted the event type and gateway_payment_id directly from the client-supplied payload, enabling attackers to mark pending bookings as paid using a simple unauthenticated POST request. The vulnerability existed because the integration did not use Yookassa's optional Webhook-Signature mechanism and avoided IP allowlisting due to proxy infrastructure concerns. Developers addressed the issue by implementing a reverse API call to fetch authoritative payment status from Yookassa before updating records, ensuring fail-closed behavior on errors. New tests cover forgery attempts, amount mismatches, and idempotency, while several additional hardening measures were deliberately deferred to keep the patch minimal and reviewable. The original unit tests had masked the problem by simulating trusted input rather than validating source authenticity.
Password Deleted from Git but Still Present: Major CI/CD Security Mistakes
Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.