Veeam has revealed a severe security flaw in its Veeam ONE 13 monitoring tool that exposes guest operating system credentials in cleartext logs, potentially allowing unauthenticated attackers to coerce SMB authentication using the service account. This vulnerability, tracked as CVE-2026-65641 and carrying a CVSS v4.0 score of 9.3, affects all Veeam ONE 13 builds up to version 13.1.0.7034. Earlier 12.x versions are not impacted.
The core issue stems from a scenario where a remote attacker, without any credentials, can force SMB authentication from the Veeam ONE service account. In Windows environments, this poses a major risk: attackers could capture Net-NTLM authentication handshakes, attempt to crack passwords offline, relay captured credentials to other services, or use service account privileges to escalate access within a network.
Who’s at Risk
The threat level hinges on how the Veeam ONE service account is configured—specifically, whether it has elevated permissions or extensive reach into backup infrastructure or Active Directory. Given that backup systems often contain sensitive data like storage credentials, hypervisor access, and disaster-recovery tools, a compromised monitoring account can open the door to widespread damage.
Steps to Mitigate & Patch
Veeam has released patches to fix the vulnerability. Users of Veeam ONE 13.1 should update to Patch 0 (build 13.1.0.7233), while those on version 13.0.2 need to apply Patch 1 (build 13.0.2.7159). All environments running earlier builds of version 13 should consider themselves exposed until patched.
In addition to applying the updates, organizations are urged to audit all Veeam ONE 13 deployments to verify build numbers. It’s also wise to monitor outbound SMB and NTLM traffic from Veeam ONE servers—especially connections over TCP port 445 to untrusted hosts—for signs of malicious activity. Implementing network controls to limit outbound SMB traffic, enabling SMB signing, and using Extended Protection for Authentication can help reduce exposure to credential relay attacks.
Applying the principle of least privilege to the Veeam ONE service account is critical. The account should avoid holding unnecessary permissions such as domain admin, local administrator, or extensive access across backup repositories or virtualization infrastructure. Log reviews are also essential; unusual authentication failures or unexpected service-account behavior could indicate attempts to exploit this flaw.
This incident underscores the ongoing danger of authentication coercion vulnerabilities in enterprise monitoring and backup tools. Robust patch management, minimal exposure of NTLM authentication, and stringent operational security practices are key to protecting critical systems and preventing credential theft and lateral movement.
Analysis: This vulnerability is a stark reminder that even peripheral tools like monitoring systems can act as weak links if not properly secured. Many organizations lean heavily on Veeam ONE for overseeing backups and virtual infrastructure—any compromise here could ripple into broader system compromises, especially in environments where backup accounts are overly privileged. Moving forward, vendors must give more attention to how their tools handle authentication and log sensitive data. For users, the takeaway is clear: patch quickly, audit account permissions, and tighten network controls around authentication channels.
