Veeam has patched a severe vulnerability in Veeam ONE, its monitoring and reporting platform for backup infrastructure, that could let an attacker with no valid credentials trick a privileged service account into leaking authentication material. The flaw, tracked as CVE-2026-65641, carries a CVSS v4.0 score of 9.3, placing it firmly in critical territory for any organization running the affected builds.

An Authentication Coercion Bug With Real Teeth

At the heart of the issue is what security researchers call an authentication coercion vulnerability. Rather than exploiting a memory corruption bug or a broken access control, the flaw abuses how the Veeam ONE service account handles certain requests, forcing it to reach out and authenticate over SMB to a destination the attacker controls. Because the request originates from the service account itself, no login, session token, or prior foothold is required on the attacker’s part.

Once that outbound SMB authentication attempt is captured, an attacker gains access to Net-NTLM hashes tied to the Veeam ONE service account. From there, the material can be used in two well-worn but still highly effective ways: cracked offline in an attempt to recover the plaintext password, or relayed in real time to another service on the network that accepts NTLM authentication, effectively letting the attacker “borrow” the account’s identity without ever knowing its password.

Why Backup Infrastructure Makes an Attractive Target

Backup and monitoring platforms like Veeam ONE typically run with elevated, wide-reaching permissions so they can inventory and report on servers, hypervisors, and backup jobs across an environment. That makes the associated service account a high-value credential: if relayed or cracked successfully, it could give an attacker a path to move laterally across the network, tamper with or exfiltrate backup data, or lay the groundwork for a ransomware deployment that also destroys the victim’s ability to recover without paying.

The vulnerability was reported through Veeam’s HackerOne bug bounty program rather than discovered in the wild, and the company documented it in Veeam Knowledge Base article 4905 on August 25, 2026. There is currently no public evidence of active exploitation, but the combination of a low bar to exploit (no authentication needed) and a high-value target makes rapid patching the priority.

Which Versions Are Affected

• Veeam ONE 13.1.0.7034 and all earlier Veeam ONE 13 builds
• Veeam ONE 13.0.2 and earlier releases
• Legacy Veeam ONE 12.x releases are not affected

Patches and Mitigation

Veeam has already shipped fixes for both affected release branches:

• Organizations on Veeam ONE 13.1 should upgrade to Patch 0, build 13.1.0.7233
• Organizations on Veeam ONE 13.0.2 should install Patch 1, build 13.0.2.7159

Where immediate patching isn’t possible, defenders can reduce exposure with a handful of network and identity hardening steps: restrict outbound SMB traffic wherever it isn’t strictly needed, enable SMB signing along with Extended Protection for Authentication, apply least-privilege permissions to the Veeam ONE service account so a compromised credential has limited blast radius, and watch authentication logs and TCP port 445 traffic for unexpected connections tied to the service account.

The Bigger Picture

Authentication coercion bugs have become a recurring theme in enterprise software over the past few years, precisely because they sidestep traditional defenses like MFA prompts or login rate limiting — the victim system authenticates on its own, without a human in the loop. For teams running Veeam ONE, this is a clear signal to treat the update as urgent rather than routine, and to review how much trust is implicitly extended to monitoring and backup service accounts across the wider environment.

Backup vendors have increasingly become a favorite target for this class of bug precisely because their products sit in a privileged position by design: to protect data, they need broad read access across an environment, and that same access becomes a liability the moment a coercion or relay flaw surfaces. Security teams evaluating this disclosure should treat it as an opportunity to audit not just Veeam ONE specifically, but any monitoring or backup tooling that runs under a domain service account with standing permissions, since the same coercion-and-relay pattern has surfaced in similar products before and is likely to keep recurring across the category.