Veeam ONE Has a Critical SMB Coercion Bug. Your Backup Server Can Be Forced to Authenticate

• The Mess: CVE-2026-65641 in Veeam ONE lets an unauthenticated network attacker coerce SMB authentication from the Veeam ONE service account. It carries a CVSS 4.0 score of 9.3 Critical, requires no privileges and no user interaction.

This is not an RCE.

It’s arguably more interesting for attackers who want credentials.

The vulnerable functionality can be abused to make the Veeam ONE service account authenticate to an attacker-controlled SMB endpoint. That can expose authentication material that may then be used in a wider attack chain, depending on the account’s privileges and network configuration.

And here’s the problem with Veeam infrastructure:

it’s valuable.

Backup servers know where everything is.

They know what systems exist.

They often have privileged access.

They hold configuration data.

They can reach virtualization platforms.

They can potentially control the recovery process for an entire organization.

That’s why ransomware operators love backup infrastructure.

Break the backups and recovery gets much harder.

• The Damage: An attacker who can reach a vulnerable Veeam ONE server could force the service account to authenticate externally, potentially exposing credentials and creating a stepping stone for NTLM relay, lateral movement or compromise of higher-value infrastructure.

The CVSS vector tells its own story:

Network. Low complexity. No privileges. No user interaction.

That’s a nasty combination.

The attacker doesn’t need to convince an employee to click anything.

They don’t need a Veeam account.

They need network access to the vulnerable service.

And once authentication is coerced, the attack can move outside Veeam ONE itself.

That’s the important distinction.

The vulnerability isn’t necessarily:

“I own your backup server.”

It’s:

“I can make your backup infrastructure authenticate to me.”

From there, the value depends on the environment.

If the service account is heavily privileged, the consequences can become much worse.

If SMB/NTLM traffic is poorly restricted, the attack surface grows.

If the Veeam ONE server can communicate freely with other internal systems, lateral movement becomes easier.

One vulnerable management server can therefore become a useful bridge into the rest of the network.

• The Fix: Upgrade Veeam ONE to 13.1.0.7233 or later immediately, or apply the appropriate fixed Veeam ONE 13.0.2 Patch 1 release, and restrict unnecessary SMB/NTLM authentication paths from the server.

Veeam’s current security documentation lists the fixed releases, while CVE-2026-65641 affects versions below 13.1 and below 13.0.2 depending on the branch.

After patching, don’t just close the ticket.

Check the service account.

Ask:

• What permissions does it have?
• Where can it authenticate?
• Can it access systems outside the backup environment?
• Is NTLM still required?
• Can the server make outbound SMB connections?
• Are there unexpected SMB authentication attempts in logs?

That’s particularly important because Veeam ONE isn’t operating in isolation.

Veeam’s own documentation notes that Veeam ONE administrators and other privileged roles can obtain visibility into infrastructure including VMware vSphere, Microsoft Hyper-V, Veeam Backup & Replication and Microsoft 365 backup environments.

In other words:

compromise the management layer and you may learn a lot about the rest of the environment.

And this isn’t the only Veeam ONE security issue being fixed.

The same update addresses several additional vulnerabilities, including an unauthenticated arbitrary-file-read flaw, SQL injection, NTLM credential capture and local privilege escalation.

So don’t patch only CVE-2026-65641.

Patch the product.

Bugstoday Opinion

Backup infrastructure should be treated like the crown jewels.

Yet organizations often protect it less aggressively than their public web servers.

That’s backwards.

An attacker doesn’t necessarily need to encrypt your production servers if they can compromise the systems responsible for recovering them.

CVE-2026-65641 is particularly nasty because it doesn’t need authentication.

It doesn’t need a victim to click anything.

It simply abuses the trust relationship around SMB authentication.

And Veeam ONE happens to sit in a very interesting place inside many corporate networks.

Bugstoday verdict: patch Veeam ONE now, then look hard at the service account. If your backup server can authenticate anywhere an attacker controls, your backup strategy just became part of the attack surface.