CVE-2020-15419: Veeam ONE Reporter XXE allows unauthenticated file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable SYSTEM-context file disclosure with a high EPSS score, though no KEV listing or known public exploit.

What it is

Veeam ONE 10.0.0.750_20200415 contains an XML External Entity (XXE) flaw in the Reporter_ImportLicense class. Because the XML parser resolves external entity references, a crafted document can make the parser fetch a URI and embed its contents into the processed XML. This lets an unauthenticated remote attacker read files on the host.

Impact

An attacker gains disclosure of file contents in the context of SYSTEM, meaning sensitive configuration, credential or system files on the Veeam ONE server can be read. There is no integrity or availability impact per the CVSS vector.

Attack surface

The flaw is network reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so an unauthenticated attacker who can reach the affected Veeam ONE service can submit the crafted XML document. No authentication is required per the description.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is recorded in the references, but EPSS is high at 0.598 (99th percentile), indicating elevated likelihood of attempted exploitation. Reference tags are only Vendor Advisory and Third Party Advisory/VDB Entry.

What to do

• Apply the Veeam fix referenced in vendor advisory KB3221 for Veeam ONE 10.0.0.750_20200415.
• Restrict network access to the Veeam ONE Reporter service to trusted management networks only.
• Disable or block external entity and DTD resolution in XML parsers where configuration is exposed.
• Monitor and alert on unexpected outbound requests from the Veeam ONE host to attacker-controlled URIs.
• Review the host for signs of file exfiltration if the service was internet-exposed.

Detection

• Inspect Veeam ONE Reporter logs for license import or XML parsing errors and unusual URI references.
• Alert on outbound HTTP/S or file URI requests originating from the Veeam ONE server process.
• Hunt for crafted XML payloads containing DOCTYPE or ENTITY declarations submitted to the Reporter_ImportLicense endpoint.
• Correlate Veeam ONE service account or SYSTEM-level file reads with anomalous process behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.