CVE-2020-10915: Veeam ONE Agent unauthenticated .NET deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8 and very high EPSS probability makes this a top remediation priority.

What it is

Veeam ONE Agent 9.5.4.4587 fails to validate user-supplied data in the HandshakeResult method, allowing deserialization of untrusted data. Because the flaw is reachable without authentication over the network, it exposes the service account to remote code execution.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the Veeam ONE Agent service account, potentially leading to full control of the affected host and any resources that account can reach.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N) required, per the CVSS vector and description. Any host that can reach the Veeam ONE Agent service can attempt exploitation.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.86619, 99.7th percentile), indicating substantial observed exploitation likelihood. Public references include a Packet Storm exploit writeup and ZDI advisory, suggesting exploit details are publicly available.

What to do

• Apply the vendor fix referenced in Veeam KB3144 for Veeam ONE Agent 9.5.4.4587.
• Restrict network access to the Veeam ONE Agent service to trusted management hosts only.
• Run the Veeam ONE Agent service under a least-privilege account to limit post-exploitation impact.
• Monitor vendor advisories for updated builds and verify the installed agent version after patching.

Detection

• Monitor for unexpected child processes spawned by the Veeam ONE Agent service account.
• Inspect network traffic to the Veeam ONE Agent service for anomalous or malformed handshake payloads.
• Alert on suspicious .NET deserialization activity or unusual assembly loads in the agent process.
• Review service account activity for lateral movement or credential access following agent connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.