CVE-2026-64630: Information Disclosure Vulnerability

CVE-2026-64630 Overview

CVE-2026-64630 is an authorization flaw (CWE-863) affecting a Veeam product that exposes report data through shared report links. A low-privileged authenticated user can retrieve report data that falls outside the scope of the link they were granted access to. The issue is documented in the Veeam Knowledge Base Article.

The vulnerability requires network access and valid low-privileged credentials but no user interaction. Impact is limited to confidentiality of report content, with no direct impact on integrity or availability of the underlying system.

Critical Impact
Authenticated low-privileged users can access report data beyond the intended scope of a shared report link, resulting in unauthorized disclosure of information.

Affected Products

Veeam product referenced in Veeam KB4892
Specific affected versions are not enumerated in the NVD record
Consult the vendor advisory for the definitive product and version list

Discovery Timeline

2026-08-04 - CVE-2026-64630 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64630

Vulnerability Analysis

The vulnerability is an incorrect authorization weakness classified under CWE-863. The application issues shared report links intended to expose only a specific subset of report data. However, the server-side authorization check does not correctly enforce the scope boundary when the request is made by a low-privileged authenticated user.

As a result, an attacker with valid low-privileged credentials can request report data that should be inaccessible under the shared link's scope. The scope of impact is confined to information disclosure. There is no reported impact on data integrity or system availability, and privilege elevation on the host is not required.

The attack vector is network-based, exploitation complexity is low, and no user interaction is needed. The Exploit Prediction Scoring System (EPSS) probability is approximately 0.236% with a percentile near 14.6, indicating low observed exploitation likelihood at the time of publication.

Root Cause

The root cause is missing or incomplete scope validation on the server-side handler that resolves report data for shared report links. The handler validates that the caller is authenticated but does not fully verify that the requested data falls within the boundary defined by the specific shared link. This mismatch between authentication and authorization is the classic pattern described by CWE-863.

Attack Vector

An attacker authenticates as a low-privileged user with legitimate access to the application. The attacker then issues requests referencing report identifiers or parameters that lie outside the scope of a shared link they hold. Because the authorization layer does not enforce the link's scope, the server returns report content the user should not be able to read. No exploit code is publicly available at the time of publication.

Exploitation details and specific request patterns are not disclosed in the NVD record. Refer to the Veeam Knowledge Base Article for vendor-provided guidance.

Detection Methods for CVE-2026-64630

Indicators of Compromise

Application or audit log entries showing a low-privileged account accessing report identifiers outside the accounts documented shared links
Unusual volume of report retrieval requests from a single authenticated session
Requests to report endpoints with enumerated or sequential identifiers from accounts that normally access a narrow report set

Detection Strategies

Enable verbose audit logging on the affected Veeam component and forward events to a central SIEM for correlation
Baseline normal report-access patterns per user role and alert on deviations, particularly for low-privileged accounts
Review historical logs since the affected version was deployed for any access to reports outside a users assigned scope

Monitoring Recommendations

Monitor authentication events for low-privileged accounts followed by broad report-enumeration activity
Track HTTP request patterns to report endpoints and flag identifiers that do not match the callers known shared links
Alert on any successful report retrievals that occur after a series of failed or 403 responses from the same session

How to Mitigate CVE-2026-64630

Immediate Actions Required

Apply the fix described in the Veeam Knowledge Base Article KB4892 as soon as it is available for your deployment
Inventory all shared report links and revoke links that are no longer required
Review low-privileged account activity for anomalous report access since the vulnerable version was deployed

Patch Information

Refer to the Veeam Knowledge Base Article KB4892 for the authoritative patch guidance, fixed version numbers, and upgrade procedure. The NVD entry does not enumerate fixed builds; follow the vendor advisory for canonical version information.

Workarounds

Restrict access to the report sharing feature to trusted user roles until the patch is applied
Rotate or invalidate existing shared report links to force re-issuance under patched logic once available
Enforce least privilege on application accounts and remove report-access entitlements from users who do not require them

bash

# Example: audit report access events from a syslog feed for low-privileged users
grep -Ei 'report_access|shared_link' /var/log/veeam/*.log \
  | awk '$0 ~ /user=/ {print $0}' \
  | sort -u