List of Security Fixes and Improvements in Veeam ONE
| KB ID: | 4858 |
| Product: | Veeam ONE |
| Published: | 2026-05-27 |
| Last Modified: | 2026-10-27 |
Get weekly article updates
Oops! Something went wrong.
Please, try again later.
Purpose
This article describes all security-related fixes and improvements introduced in each release or update of Veeam ONE.
This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam ONE version to a later one.
Security Fixes and Improvements
13.1.0.7940
- CVE-2026-107671 vulnerability was fixed.
- BouncyCastle.Cryptography upgraded to version 2.7.0
- brace-expansion upgraded to version 5.0.1
- dompurify upgraded to version 3.4.15
- flatted upgraded to version 3.4.4
- minimatch upgraded to version 10.2.3
- OpenSSL upgraded to version 3.5.9
- picomatch upgraded to versions 2.3.2 and 4.0.4
- uri-js was replaced with fast-uri 3.1.8
- ws upgraded to version 7.5.13
13.1.0.7233
- CVE-2026-65641 vulnerability was fixed.
Vulnerability Scanner False Positive after Update Install
After Veeam ONE 13.1.0.7233 is installed, some vulnerability scanners may continue to report the finding because the Veeam ONE Reporter executable remains at version 13.1.0.7034. This patch does not modify that component, so its version number is unchanged. If a scanner finding is based only on the Reporter component version, confirm that build 13.1.0.7233 is installed, and then configure an exception for that specific detection in the scanner.
13.1.0.7034
- CVE-2026-64633 vulnerability was fixed.
- CVE-2026-58075 vulnerability was fixed.
- CVE-2026-58074 vulnerability was fixed.
- CVE-2026-64631 vulnerability was fixed.
- CVE-2026-64632 vulnerability was fixed.
- CVE-2026-64634 vulnerability was fixed.
- CVE-2026-64630 vulnerability was fixed.
- AutoMapper was replaced with MagicMapper 14.0.1.
- Azure.Identity upgraded to version 1.17.2
- @babel/runtime upgraded to version 7.29.2
- dompurify upgraded to version 3.4.11
- ip-address upgraded to version 10.1.1
- Microsoft.IdentityModel.JsonWebTokens upgraded to version 8.17.0
- System.IdentityModel.Tokens.Jwt upgraded to version 8.17.0
- System.Private.Uri upgraded to version 4.3.2
- System.Security.Cryptography.Xml upgraded to version 10.0.7
- vite upgraded to version 8.0.16
13.0.2.7159
- CVE-2026-64633 vulnerability was fixed.
- CVE-2026-58075 vulnerability was fixed.
- CVE-2026-58074 vulnerability was fixed.
- CVE-2026-64631 vulnerability was fixed.
- CVE-2026-64632 vulnerability was fixed.
- CVE-2026-64634 vulnerability was fixed.
- CVE-2026-64630 vulnerability was fixed.
- CVE-2026-65641 vulnerability was fixed.
- d3-color upgraded to version 3.1.0
- dompurify upgraded to version 3.4.11
- OpenSSL upgraded to version 3.0.21
- SQLite (SQLitePCLRaw e_sqlite3) upgraded to version 3.0.3
13.0.2.6723
- AutoMapper was replaced with MagicMapper 14.0.1.
- dompurify upgraded to version 3.4.2
- postcss upgraded to version 8.5.13
- System.Security.Cryptography.Xml upgraded to version 8.0.3
- uuid upgraded to version 14.0.0
- vite upgraded to version 4.5.14
12.3.0.7165
- CVE-2026-64631 vulnerability was fixed.
- CVE-2026-64632 vulnerability was fixed.
- CVE-2026-58074 vulnerability was fixed.
More Information
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
