This vulnerability in Veeam ONE enables an unauthenticated attacker to bypass authentication controls and read arbitrary files from the host system. The ability to access arbitrary files without authentication can be further exploited to escalate privileges on the local machine. The CVSS 4.0 base score is 8.7, reflecting a network attack vector with no required privileges or user interaction, and high impact on confidentiality. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported as of the publication date.

An attacker can read arbitrary files on the host without authentication, potentially exposing sensitive information. This unauthorized access can be used to escalate privileges locally, increasing the risk of further compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Veeam ONE service and monitor for suspicious activity related to unauthorized file access attempts.