CVE-2026-65641

Critical Veeam ONE Flaw Allows Remote Attackers to Expose Service Account Credentials via Forced SMB Authentication

Veeam has patched a critical vulnerability in Veeam ONE that enables a remote unauthenticated attacker to force SMB authentication attempts using the platform's service account. Identified as CVE-2026-65641 with a CVSS score of 9.3, the flaw impacts version 13.1.0.7034 and all prior builds of the 13.x line, while 12.x installations remain unaffected. Exploitation allows an attacker to redirect SMB authentication to a controlled server, exposing Net-NTLM material that can be used for offline password cracking or NTLM relay attacks against other services. The severity depends on the privileges of the compromised account, with elevated risk in environments where Veeam ONE runs with high privileges or broad access to Active Directory, backup servers, and hypervisors. Patches are available in Veeam ONE 13.1 Patch 0 (build 13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159), and organizations are urged to apply updates immediately.

Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641

Veeam Software has released updates for its backup environment monitoring tool Veeam ONE to address multiple vulnerabilities. The advisory covers the 13.x series and includes fixes rated as critical under CVSSv4.0. One flaw, CVE-2026-65641, allows service accounts to perform SMB authentication and carries a base score of 9.3. Additional high-severity issues such as CVE-2026-64633 with a perfect 10.0 score were also resolved in the patches. The company updated its disclosure to include seven vulnerabilities fixed in version 13.1.0.7034 after initially reporting six. Patches are now available for both the 13.x and 12.x branches, with the latest 12.3 Patch 1 backporting several fixes from the 13 series.