Veeam has identified a serious security flaw in its Veeam ONE 13 software, potentially allowing unauthorized remote access to sensitive system credentials. This vulnerability, labeled as CVE-2026-65641, holds a severity score of 9.3 according to the CVSS v4.0 scale and was uncovered through the HackerOne program.
Details of the Vulnerability
The vulnerability affects all versions of Veeam ONE 13 prior to build 13.1.0.7034, with legacy 12.x versions remaining unaffected. The issue arises when an unauthenticated remote attacker can initiate SMB authentication attempts from the service account associated with Veeam ONE, risking exposure of Net-NTLM credentials.
In Windows environments, such vulnerabilities are particularly concerning, as they allow attackers to capture authentication exchanges. This can lead to offline password cracking or credential relaying to further compromise network security.
Impact on Organizational Security
The severity of this vulnerability depends largely on the configuration of the Veeam ONE service account, especially if it possesses elevated privileges or access to critical infrastructure elements. Organizations using Veeam ONE for monitoring backup and virtual systems are at significant risk, as these environments often include privileged access credentials.
Veeam has documented the flaw in its Knowledge Base article 4905, dated August 25, 2026. A compromise of service account credentials could facilitate unauthorized access to vital backup management systems.
Recommended Mitigation Measures
To address this flaw, Veeam has released updates for affected software versions. Users of Veeam ONE 13.1 should upgrade to Patch 0 (build 13.1.0.7233), while users of version 13.0.2 should apply Patch 1 (build 13.0.2.7159). It is crucial for administrators to verify and update their systems accordingly.
Security teams are advised to scrutinize SMB and NTLM authentication activities from Veeam ONE servers. Monitoring outbound connections, especially on TCP port 445, can indicate attempts at unauthorized access.
Implementing network controls to restrict SMB traffic and employing measures such as SMB signing can help minimize the risk of credential relay. Additionally, adhering to the principle of least privilege for service accounts is essential to mitigate potential threats.
Organizations should remain vigilant by monitoring logs for unusual authentication attempts or unauthorized access to backup systems. Prompt application of Veeam’s patches and minimizing NTLM exposure are crucial for safeguarding against credential theft and lateral movement across the network.
This disclosure emphasizes the persistent threat posed by authentication vulnerabilities in enterprise software. Proactive measures and timely updates are vital to maintaining robust security postures.
