The account a Veeam backup server uses to log into the machines it protects was being written down on those machines, in plain text, in a log file.
Veeam published the flaw on 25 August as CVE-2026-58070, describing it in its own words as a vulnerability that causes guest OS credentials used for Application Aware processing to be recorded in cleartext in logs on the guest machine. The detail is in Veeam's KB4902, and Hong Kong's HKCERT carried the bulletin a day later. Veeam says the issue came in through its HackerOne programme and has not named the reporter.
A backup account, left where guests can read it
Application aware processing is the feature that lets Veeam take a clean backup of a live database or mail server instead of a crash consistent copy of its disk. To do that, the backup server logs into the guest operating system using credentials an administrator has handed it in advance. Those are the credentials that ended up in the log.
Veeam scores the issue 6.8, medium, on CVSS v4.0, with the vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N. Read left to right, that vector describes the shape of the problem better than the number does. An attacker needs local access to the guest machine and only low privileges once there. Nothing gets broken and nothing gets changed. What they get is confidentiality impact rated high, which here means the credential itself.
So this is not a way in. It is a way to convert a foothold on one backed up server into the account the backup infrastructure uses elsewhere, and backup service accounts are rarely scoped narrowly.
Why backup servers are worth the trouble
Ransomware crews go after backup infrastructure deliberately, because an operator who cannot restore is an operator who pays. Akira, the crew Sophos recorded most often across its 2024 incident response cases, reached victims through an earlier Veeam Backup and Replication flaw, CVE-2024-40711, as we covered in our write up of that Sophos data.
Nothing published so far ties CVE-2026-58070 to any intrusion. Veeam has not reported exploitation, and neither has anyone else. It is worth patching on its own merits rather than on an assumed attack.
Upgrade to 13.1.0.411 or 13.0.3.63
Veeam lists Backup and Replication 13.0.2.29 and all earlier version 13 builds as affected. The fixes are version 13.1, build 13.1.0.411, and version 13.0.3, build 13.0.3.63. There is no workaround in the advisory, so the upgrade is the fix.
One point the advisory does not settle, and that defenders should think through themselves: upgrading stops the logging, but it does not reach back into log files that were already written. Where those logs are retained, shipped to a central collector or swept up in a guest level backup, the credentials in them are as readable as they were on the day they were recorded. IntelFusions assesses that reviewing retention on affected guests, and rotating the application aware processing accounts, is the prudent follow up. Veeam does not say this, and it is our judgment rather than the vendor's.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.