Threat database

Active exploitation of PAN-OS vulnerability CVE-2026-0257 targets GlobalProtect portal and gateway components. This authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware actors exploit this vulnerability to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Sophisticated tactics involve pivoting to the virtualization layer, accessing vCenter management appliances, disabling ESXi hypervisor security controls, and offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

CVE-2026-64632 is a high-severity vulnerability in Veeam ONE that allows a low-privileged user to capture the NTLM credentials of the Reporter service account. This issue relates to insufficient protection of credentials (CWE-522). No patch or official remediation guidance has been provided yet.

CVE-2026-58070 is a vulnerability in Veeam Backup and Replication where guest OS processing credentials are recorded in cleartext within a support log on the guest system. This allows any user with read access to that log to recover privileged account credentials. The vulnerability has a medium severity rating with a CVSS score of 6.8. No specific affected versions or patches are currently documented.

CVE-2026-65641 is a critical authentication bypass vulnerability in Veeam One that allows an unauthenticated network attacker to coerce SMB authentication from the service account. This vulnerability is classified under CWE-288, indicating an authentication bypass using an alternate path or channel. The CVSS 4.0 base score is 9.3, reflecting its critical severity. No affected versions or patch information are currently provided, and no known exploits are reported in the wild.

CVE-2026-58072 is a critical path traversal vulnerability in Veeam Service Provider Console that allows arbitrary file write on the management server. This flaw can lead to remote code execution if exploited. The vulnerability is identified as CWE-22 and has a CVSS 4.0 score of 9. No specific affected versions or patches have been disclosed yet. There are no known exploits in the wild at this time.

CVE-2026-58074 is a high-severity code injection vulnerability in Veeam ONE that allows a high-privileged user to execute arbitrary code on the server. The vulnerability is identified as CWE-94 and has a CVSS 4.0 base score of 8.6, indicating significant impact if exploited. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-64630 is a medium severity vulnerability in Veeam ONE that allows a low-privileged user to access report data beyond the intended scope of a shared report link. This is due to incorrect authorization controls (CWE-863). No specific affected versions or patches are currently identified.

CVE-2026-58073 is a critical authentication bypass vulnerability in Veeam Service Provider Console. It allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials. The vulnerability is classified under CWE-288, indicating an authentication bypass using an alternate path or channel. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-64631 is a high-severity SQL Injection vulnerability in Veeam ONE that allows a low-privileged user to inject SQL commands and extract database contents. This vulnerability does not have a confirmed patch or official remediation at the time of publication. No known exploits in the wild have been reported. The vulnerability impacts confidentiality and integrity with high scope and impact metrics according to CVSS 4.0 scoring.

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

CVE-2026-64633 is a critical remote code injection vulnerability in Veeam ONE that allows unauthenticated attackers to execute arbitrary code on the agent host. It has a CVSS 4.0 base score of 10. No patch or official remediation guidance is currently provided by the vendor. The vulnerability is classified under CWE-94 (Code Injection).

CVE-2026-64634 is a high severity vulnerability in Veeam ONE that allows local privilege escalation to the Reporter service context. It involves improper privilege management (CWE-269), enabling an attacker with some level of local access to escalate privileges. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-58071 is a high-severity vulnerability in Veeam Service Provider Console that allows an unauthenticated attacker to access the proxied appliance API with asPortal Administrator privileges during a brief window after an administrator session starts. This issue is due to missing authentication for a critical function (CWE-306). No patch or official remediation guidance is currently available.

CVE-2026-58067 is a high-severity vulnerability in Veeam Service Provider Console that allows an unauthenticated attacker to exhaust host memory, resulting in a denial of service condition. The flaw is related to improper handling of memory allocation with excessive size values (CWE-789). No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.