Veeam ONE Vulnerability Exposes Service Account Credentials via SMB Coercion
A critical vulnerability in Veeam ONE 13 allows unauthenticated attackers to steal service account credentials through SMB authentication coercion, potentially leading to network compromise.
Veeam has disclosed a critical security vulnerability, tracked as CVE-2026-65641, affecting Veeam ONE 13. This flaw allows unauthenticated remote attackers to coerce SMB authentication from the product's service account. With a CVSS v4.0 score of 9.3, the vulnerability poses a significant risk to organizations relying on Veeam ONE for monitoring their backup and virtual infrastructure.
The vulnerability stems from a flaw where a remote, unauthenticated attacker can trick the Veeam ONE service account into initiating an SMB authentication attempt towards an attacker-controlled server. In Windows environments, this can lead to the exposure of Net-NTLM authentication material. Attackers can then capture this material to attempt offline password cracking, relay the captured credentials to other services for lateral movement, or leverage the service account's permissions to gain deeper access within the network.
The potential impact of this vulnerability is heavily dependent on the privileges assigned to the Veeam ONE service account. If this account holds elevated privileges, has access to backup infrastructure, or possesses broad permissions across Active Directory environments, a compromise could be particularly devastating. Backup environments are often prime targets due to the sensitive data and administrative access they contain, including hypervisor controls and disaster recovery systems.
Veeam has officially documented this issue in Knowledge Base article 4905, published on August 25, 2026. The company emphasizes that the compromise of a monitoring service account could provide attackers with a critical pathway into sensitive backup administration systems.
To address CVE-2026-65641, Veeam has released patches for affected versions. Users of Veeam ONE 13.1 should upgrade to Veeam ONE 13.1 Patch 0, build 13.1.0.7233. Those running Veeam ONE 13.0.2 are advised to install Patch 1, build 13.0.2.7159. Veeam confirms that these updated builds resolve the vulnerability.
Organizations are urged to identify all Veeam ONE 13 deployments and verify their current build numbers. Any installations running versions earlier than the specified patched builds should be considered vulnerable until updated. Security teams should also proactively review outbound SMB and NTLM authentication activity originating from Veeam ONE servers, as unexpected connections to untrusted hosts, especially on TCP port 445, could indicate an attempted exploitation.
Implementing network controls to restrict outbound SMB traffic can significantly reduce exposure. Additionally, enabling SMB signing and Extended Protection for Authentication can help mitigate credential relay risks. Adhering to the principle of least privilege for the Veeam ONE service account, ensuring it does not possess unnecessary administrative or backup-related permissions, is also a crucial defensive measure. Continuous monitoring of authentication logs for failures, unusual service account behavior, and suspicious access patterns to backup systems can aid in detecting potential abuse.