Veeam ONE contains a local privilege escalation flaw that allows authorized administrators to gain unauthorized access to the Reporter service context.

This issue is a CWE-269 improper privilege management flaw. It enables an attacker who already possesses high privileges to further escalate their status to the Reporter service context, effectively bypassing intended security boundaries.

By escalating to the Reporter service context, an attacker can gain total control over the service's functions, leading to potential system-wide disruption or unauthorized configuration changes. The CVSS score of 8.4 confirms the high risk associated with this escalation vector.

Immediate Action: Review the Veeam Knowledge Base (KB4892) and apply the latest security patches provided by the vendor.

Proactive Monitoring: Audit administrative user activity and monitor service account behaviors for unauthorized actions or privilege misuse.

Compensating Controls: Adhere to the principle of least privilege by strictly controlling which users have administrative access to the server hosting the Veeam ONE software.

Public Exploit Available: No

All administrators should monitor official Veeam security channels for the release of patches addressing this vulnerability. Given the risk of total privilege escalation, patching should be performed as soon as the vendor provides a resolution to prevent potential system compromise by malicious insiders or compromised administrative accounts.