CVE-2020-10914: Veeam ONE Agent unauthenticated .NET deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable deserialization leading to code execution as a service account, with a CVSS of 9.8 and very high EPSS.

What it is

Veeam ONE Agent 9.5.4.4587 fails to validate user-supplied data in the PerformHandshake method, allowing deserialization of untrusted data. Because the flaw is reachable without authentication over the network, it exposes the service to remote code execution.

Impact

An attacker can execute arbitrary code in the context of the Veeam ONE Agent service account, which typically carries broad privileges over the monitored environment.

Attack surface

Reached over the network via the agent's handshake interface; the CVSS vector (AV:N/PR:N/UI:N) and description confirm no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.479 (98.8th percentile), and public technical write-ups exist via Packet Storm and ZDI.

What to do

• Apply the vendor fix referenced in Veeam KB3144 for Veeam ONE Agent 9.5.4.4587.
• Restrict network access to the Veeam ONE Agent handshake port to trusted management hosts only.
• Run the agent service under a least-privilege account rather than a highly privileged service account.
• Monitor for and block unexpected inbound connections to agent endpoints from untrusted segments.

Detection

• Alert on Veeam ONE Agent service crashes or restarts that may indicate malformed deserialization payloads.
• Monitor for child processes spawned by the Veeam ONE Agent service, especially shells or scripting hosts.
• Inspect network traffic to agent handshake ports for anomalous or oversized serialized payloads.
• Review agent service account activity for unexpected command execution or lateral movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.