Critical Veeam ONE Flaw Lets Unauthenticated Attackers Coerce SMB Authentication From Service Accounts

Veeam has released security updates for a critical vulnerability in Veeam ONE that could allow an unauthenticated network attacker to coerce SMB authentication from the account running an affected service.

Tracked as CVE-2026-65641, the vulnerability received a CVSS v4.0 severity score of 9.3. Veeam disclosed the issue through Knowledge Base article 4905, published on August 25, 2026, and said the flaw was reported via HackerOne.

The vulnerability affects Veeam ONE 13.1.0.7034 and all earlier version 13 builds. Older Veeam ONE 12.x versions are not impacted, according to the company. Veeam resolved the issue in Veeam ONE 13.1 Patch 0, build 13.1.0.7233, and Veeam ONE 13.0.2 Patch 1, build 13.0.2.7159.

Critical Veeam ONE Flaw

The flaw enables a remote, unauthenticated attacker to force the vulnerable Veeam ONE service to initiate an SMB authentication attempt. This behavior can expose Net-NTLM authentication material associated with the Veeam ONE service account to an attacker-controlled server.

Authentication coercion vulnerabilities are particularly significant in Windows enterprise environments because captured authentication exchanges may support relay attacks or offline password-cracking attempts, depending on the target configuration and account protections.

The potential impact is higher where Veeam ONE services operate under privileged domain accounts, local administrator accounts, or accounts with access to backup infrastructure.

An attacker would need network access to the affected Veeam ONE deployment, but would not need valid Veeam credentials to exploit the flaw.

That lowers the barrier for internal attackers, compromised endpoints, or adversaries that have already established a foothold inside an organization’s network.

Veeam urged customers to update affected Veeam ONE installations without delay. The company noted that patch disclosure poses a risk that attackers may reverse-engineer the fix and develop exploits targeting organizations that have not yet applied the update.

Administrators should identify all Veeam ONE version 13 deployments and upgrade them to one of the remediated builds. Organizations should also review the privileges assigned to Veeam ONE service accounts and, where possible, avoid using highly privileged domain accounts.

Security teams can further reduce exposure by restricting unnecessary SMB traffic between management systems and untrusted network segments, monitoring outbound SMB authentication attempts, and enforcing SMB signing where operationally feasible.

Monitoring for unusual NTLM authentication activity involving Veeam ONE service accounts may help identify attempted coercion or relay activity.

The disclosure adds to the continued security pressure surrounding backup and recovery infrastructure, which remains a high-value target for ransomware operators and other threat actors.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC