This bulletin covers Veeam Backup & Replication 13.1, Veeam ONE 13.1, Veeam Backup for Microsoft 365 8.6, the Plug-in for Microsoft Azure, and the 12.3.2 Patch 4 release for anyone still on version 12. Every item carries the build or CVSS score Veeam published it under.

Patch Veeam ONE first — and in this order

Veeam ONE 13.1.0.7233 fixes CVE-2026-65641, rated Critical at CVSS v4.0 9.3. An unauthenticated network attacker can coerce SMB authentication from the Veeam ONE service account. It affects Veeam ONE 13.1.0.7034 and earlier version 13 builds; version 12.x is not affected. It is also fixed in Veeam ONE 13.0.2 Patch 1 (13.0.2.7159).

Two things make this more than a routine patch.

The order matters. If a monitored backup server is going to VBR 13.0.3, Veeam ONE has to be at 13.1.0.7233 or later first. The older 13.1.0.7034 build can detect VBR 13.0.3 incorrectly and data collection fails with a timeout. Upgrade Veeam ONE, then VBR.

Treat the Veeam ONE upgrade as disruptive maintenance. When Veeam ONE is upgraded, its Veeam Analytics Service can update itself automatically on connected VBR servers. On Windows backup servers, installing a missing or outdated .NET or ASP.NET Core prerequisite can trigger an automatic reboot. Veeam says so itself. Book a window rather than running it on a Tuesday afternoon.

One more thing to expect afterwards: your vulnerability scanner may keep flagging CVE-2026-65641 even once 13.1.0.7233 is installed, because the Reporter executable stays at version 13.1.0.7034. If the finding is based only on that file version, confirm the installed build and add a scanner exception.

Veeam Backup & Replication 13.1: patch, then change your credentials

The current 13.1 build is 13.1.1.18, released to incorporate Veeam Plug-in for Microsoft Azure v9.1.

Two CVEs were resolved in 13.1.0.411 and later:

• CVE-2026-58069 — High, CVSS v4.0 8.3. An authenticated Veeam Cloud Connect tenant can read arbitrary files on the service provider host. Affects Windows-based VBR. If you run Cloud Connect for customers, this one is about tenant isolation on your own infrastructure.
• CVE-2026-58070 — Medium, CVSS v4.0 6.8. Guest OS credentials used for Application-Aware processing were written to logs in cleartext on the guest machine.

CVE-2026-58070 does not end when you patch. The fix stops new passwords being logged, but it does not remove log files that already exist. Veeam’s guidance is to change the credentials used for Application-Aware processing. If you have not rotated those accounts, patching alone leaves the exposure in place.

13.1.0.411 and later also pick up updates to bundled third-party components, including OpenSSL, curl, SQLite and .NET.

Also fixed in 13.1.1.18

A Veeam Software Appliance proxy-related service startup issue; object storage repository jobs failing with “Blockset blocks immutability mismatch”; application-aware processing problems involving PostgreSQL on Windows guests; Windows Server 2025 guest-processing issues; backup copy job cache issues; S3 Direct Connection mode issues; and file-level restore problems in Veeam Agent for Windows. The release also adds Linux agent support for RHEL 9.8, RHEL 10.2 and Ubuntu 26.04 LTS.

Still on version 12? 12.3.2 Patch 4 is not optional

Build 12.3.2.4934 was published on 6 October 2026 and fixes three vulnerabilities. It affects 12.3.2 P3 (12.3.2.4854) and earlier version 12 builds. Version 13 is not affected.

• CVE-2025-64393 — Critical, CVSS v4.0 9.4. A user holding only the Backup Viewer role could execute code on the backup server through insecure deserialization of data received via the Mount Service. A read-only role turning into code execution on a Tier-0 asset is the worst shape a backup vulnerability can take.
• CVE-2026-93026 — Medium, CVSS v4.0 6.1. An authenticated Backup Viewer could modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials.
• CVE-2025-64392 — Medium, CVSS v4.0 4.8. Reflected cross-site scripting in Veeam Backup Enterprise Manager, triggered if an authenticated user opens a crafted link.

If you have been treating the Backup Viewer role as harmless when handing out access, these are a reason to revisit who holds it.

Veeam Backup for Microsoft 365 8.6

Version 8.6.0.1102. The headline item is repository remediation: new PowerShell cmdlets that repair affected data in JET repositories, Backup Copy repositories and immutable repositories. These relate to the integrity issue documented in KB4835 and KB4874 — if those articles applied to you, this release is how you clean up. Integrity Check also gets broader validation coverage, and there are further repository integrity and repair improvements.

Alongside that: support for Microsoft Exchange Server Subscription Edition; SharePoint site permissions and members are now preserved when a site is restored to a new location; Teams channel terminology moves from “chats” to “posts”; backup performance improves for large SharePoint sites and for Exchange mailboxes holding very large numbers of items; and the REST API gets further work.

Veeam Plug-in for Microsoft Azure 9.1

Version 9.1, build 13.9.1.407. Storage-account credentials were previously stored in plaintext on worker appliances; that is addressed in this release. Configuration backup fixes cover a failure that appeared after upgrading VBR to 13.1, and an Azure appliance synchronisation failure reporting that it “cannot write a null value for property ‘createdBy'”.

Other current plug-in builds

• Veeam Plug-in for Red Hat OpenShift Virtualization — 13.1.0.428 (Linux and Windows versions are both in Veeam’s current download catalogue)
• Veeam Plug-in for Scale Computing HyperCore — 13.4.1.328

Need help sequencing the upgrade?

Arrosoft manages Veeam environments for partners and their customers across APAC and North America. If you would like us to check which builds your estate is actually running, work out the Veeam ONE and VBR upgrade order, and schedule the rollout, get in touch.

Full detail: KB4902 — vulnerabilities resolved in Veeam Backup & Replication 13.1, KB4905 — CVE-2026-65641, and KB4934 — vulnerabilities resolved in 12.3.2 P4.