This vulnerability in Veeam ONE involves improper authentication (CWE-287) that permits an unauthenticated attacker to read arbitrary files from the host system. Such unauthorized access to files can be exploited to gain elevated privileges on the local machine. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker can remotely read arbitrary files without authentication, potentially exposing sensitive data. This access can be further used to escalate privileges locally, increasing the risk of full system compromise or unauthorized administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Veeam ONE service and monitor for suspicious activity related to unauthorized file access attempts.