Retrospective for 2026-08-30, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.
What this advisory changes in your environment
The starting point is CERTFR-2026-AVI-1080, published on 2026-08-26. Its scope includes Veeam ONE, Veeam Backup & Replication. Reported consequences are security control bypass, loss of confidentiality. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.
This case contains 2 version entries; CVE identifier count: 2. Track remediation by component: a successful overall update does not demonstrate that Veeam ONE and Veeam Backup & Replication each received their respective fix.
Products and versions to examine
- Reference
- CERTFR-2026-AVI-1080
- Source first published
- 2026-08-26
- Latest source revision available for this day
- 2026-08-26
- Named components
- Veeam ONE, Veeam Backup & Replication
- CVE identifiers
- CVE-2026-58070, CVE-2026-65641
| Component | Published condition |
|---|---|
| Veeam ONE | 13.x : < 13.0.2 Patch 1 |
| Veeam Backup & Replication | 13.x : < 13.0.3 |
For Veeam ONE, the published condition is “13.x : < 13.0.2 Patch 1”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of Veeam ONE, Veeam Backup & Replication does not close this case.
Mechanism and prerequisites
A security bypass challenges a trust boundary. Verify server-side authorisation decisions and alternative paths; hiding an interface is not an access restriction.
The primary record CVE-2026-65641, published by hackerone, covers One. The retained revision is dated 2026-08-27. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-1080.
The published metric for CVE-2026-65641 is CVSS 4.0, 9.3/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
- Attack vector
- Not specified in the retained source
- Prior privileges
- Not specified in the retained source
- User interaction
- Not specified in the retained source
- Complexity
- Not specified in the retained source
- Weakness
- CWE-288
Choose the appropriate intervention
- Locate Veeam ONE instances, running releases and service owners. Record condition 13.x : < 13.0.2 Patch 1 in the ticket alongside reference CERTFR-2026-AVI-1080.
- Compare the installed branch with the vendor’s Veeam ONE release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
- After changing Veeam ONE, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.
Verify the fix in a real workflow
Validation scenario to adapt for Veeam ONE, Veeam Backup & Replication: For Veeam ONE, restore a synthetic dataset into an isolated environment and compare it with a reference. Check the management plane separately from the recovery path; a successful backup status does not prove service recovery. This is a proposed defensive check, not a claim that testing was performed against third-party systems.
Limit of case CERTFR-2026-AVI-1080: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.
Questions specific to this case
Which condition should be checked for Veeam ONE?
Advisory CERTFR-2026-AVI-1080 states: Veeam ONE — 13.x : < 13.0.2 Patch 1. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.
Why not use one fix for Veeam ONE and Veeam Backup & Replication?
CERTFR-2026-AVI-1080 distinguishes these components within a scope containing 2 entries. Match each branch to its own update documentation and functional check.
Which prerequisites does record CVE-2026-65641 specify?
For CVE-2026-65641, the published vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L. Verify those conditions on One before applying them to an integration named in CERTFR-2026-AVI-1080.
Sources and related reading
- CERT-FR · CERTFR-2026-AVI-1080
- Vendor and remediation · www.veeam.com
- Vendor and remediation · www.veeam.com
- CVE-2026-65641 · CNA
Practical guide : Test a backup restoration from copy to working service
Explore the decision addressed in this case
Complete source advisory inventory
The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.
Official source · CERTFR-2026-AVI-1080
Advisory revision : · Checked on :
Affected systems · 2
Original French wording is retained to avoid ambiguous translations of version conditions.
- Veeam ONE versions 13.x antérieures à 13.0.2 Patch 1
- Veeam Backup & Replication versions 13.x antérieures à 13.0.3