Veeam ONE Fixed a CVSS 10 RCE. Another Flaw Can Coerce SMB Authentication

The version guidance matters. Veeam ONE 13.1.0.7034 fixed the earlier group of vulnerabilities, including the CVSS 10.0 issue, but that build remains affected by the newer SMB authentication flaw. Organisations on the 13.1 branch should therefore move to Veeam ONE 13.1 Patch 0, build 13.1.0.7233. Veeam ONE 13.0.2 deployments should install Patch 1, build 13.0.2.7159.

There is no confirmed malicious exploitation and none of the eight vulnerabilities is in CISA’s Known Exploited Vulnerabilities catalogue as of 28 August 2026. That distinction is important, but it is not a reason to delay. The two unauthenticated network attack paths sit inside a product that monitors backup and infrastructure environments, where service accounts, management connectivity and operational visibility can make compromise unusually valuable.

The two issues that should drive the maintenance window

Unauthenticated code execution on the agent host

CVE-2026-64633 carries a CVSS v4.0 score of 10.0. Veeam describes it as remote, unauthenticated code execution on the Veeam ONE agent host. The attack vector is network based, attack complexity is low, no privileges or user interaction are required, and Veeam assigns high impact across confidentiality, integrity and availability for both the vulnerable and subsequent systems.

Veeam ONE 13.0.2.6723 and earlier version 13 builds are affected. The flaw was fixed in Veeam ONE 13.1.0.7034 and in 13.0.2 Patch 1, build 13.0.2.7159. Veeam says version 12.x is not affected by this specific vulnerability.

An SMB authentication path with no login requirement

CVE-2026-65641 carries a CVSS v4.0 score of 9.3. It allows an unauthenticated network attacker to coerce SMB authentication from the Veeam ONE service account. In practical terms, the vulnerable service can be induced to make an outbound SMB authentication attempt to a system controlled by an attacker.

Veeam’s short advisory does not claim that the underlying password is directly disclosed, and it does not document a complete credential-relay chain. However, coerced SMB and NTLM authentication can expose challenge-response material to capture, cracking or relay attempts when the surrounding Windows environment permits it. Microsoft recommends SMB signing to protect against relay and spoofing, and recommends Kerberos or NTLM blocking where operationally possible.

Veeam ONE 13.1.0.7034 and all earlier version 13 builds are affected. The fixed builds are 13.1.0.7233 and 13.0.2.7159. Veeam states that older releases such as version 12.x are not affected by this specific flaw.

The rest of the Veeam ONE bulletin

The 13.0.2 Patch 1 release contains six additional vulnerabilities. They should not be hidden behind the two critical scores because several cross meaningful trust boundaries:

• CVE-2026-58075, CVSS 8.7: an unauthenticated network attacker can read arbitrary files from the host, which Veeam says can then be used to escalate privileges locally. Veeam ONE 13.0.2.6723 and earlier version 13 builds are affected. Fixes are in 13.1.0.7034 and 13.0.2.7159. Version 12.x is not affected.
• CVE-2026-58074, CVSS 8.6: a highly privileged user can execute arbitrary code on the Veeam ONE server. Version 13.0.2.6723 and earlier version 13 builds are affected, as are 12.3.0.4670 and earlier version 12 builds. Fixed releases are 13.1.0.7034, 13.0.2.7159 and 12.3.0.7165. Veeam says unsupported versions were not tested but are likely affected.
• CVE-2026-64631, CVSS 8.6: a low-privileged user can inject SQL and extract database contents. The affected and fixed version ranges match the preceding code-execution issue, including the 12.3.0.7165 fix for version 12.
• CVE-2026-64632, CVSS 8.5: a low-privileged user can capture NTLM credentials belonging to the Reporter service account. The issue affects version 13 builds through 13.0.2.6723 and version 12 builds through 12.3.0.4670. It is fixed in 13.1.0.7034, 13.0.2.7159 and 12.3.0.7165.
• CVE-2026-64634, CVSS 8.4: a local, highly privileged attacker can escalate into the Reporter service context. It affects Veeam ONE 13.0.2.6723 and earlier version 13 builds and is fixed in 13.1.0.7034 and 13.0.2.7159. Version 12.x is not affected.
• CVE-2026-64630, CVSS 5.3: a low-privileged user can retrieve report data beyond the scope of a shared report link. It affects Veeam ONE 13.0.2.6723 and earlier version 13 builds and is fixed in 13.1.0.7034 and 13.0.2.7159. Version 12.x is not affected.

Veeam does not publish a workaround for these vulnerabilities. The vendor-documented remediation is to install the fixed release for the deployed branch. This is also a cumulative operational update, so administrators should read the release notes and plan for service interruption during installation.

What defenders should do now

1. Inventory the exact Veeam ONE build. Do not treat “13.1” as sufficient. Build 13.1.0.7034 still needs Patch 0 to close the SMB authentication flaw.
2. Patch to the current branch target. Use 13.1.0.7233 for the 13.1 branch or 13.0.2.7159 for the 13.0.2 branch. Apply 12.3.0.7165 where version 12 remains in use and confirm whether unsupported releases can be retired.
3. Restrict the management plane. Limit network access to Veeam ONE server and agent services to authorised administration and monitoring systems. Backup monitoring should not be reachable from ordinary user or untrusted network segments.
4. Control outbound SMB. Monitor and, where business requirements allow, block TCP port 445 from Veeam ONE servers and agent hosts to untrusted destinations. Require SMB signing, prefer Kerberos and assess NTLM blocking on supported Windows versions.
5. Review service-account exposure. Confirm least privilege, managed credential rotation and logon restrictions for Veeam ONE service accounts. Investigate unexpected NTLM authentication, outbound SMB sessions or service-account access to new systems.
6. Hunt with the available evidence. Look for unusual child processes launched by Veeam ONE services or agents, unexpected file access and database activity, and anomalous connections from monitoring hosts. Veeam has not published endpoint-level exploit details, so detections should remain behavioural rather than tied to an unverified request pattern.

Exploitation and proof-of-concept status

As of 28 August 2026, BlackTree found no confirmed in-the-wild exploitation, no CISA KEV entries and no credible, independently reproduced public exploit for any of the eight vulnerabilities. A public repository using the CVSS 10.0 identifier contains generated payload documents, not a demonstrated Veeam ONE exploit, and should not be treated as a validated proof of concept.

That evidence can change quickly. Veeam explicitly warns that attackers may reverse-engineer its patches after disclosure. The absence of a confirmed campaign narrows the claim, but the unauthenticated RCE, arbitrary file read and SMB-authentication paths still justify an accelerated maintenance window.

Source timing and references

• Veeam KB4892 was first published on 4 August 2026 and last modified on 25 August 2026. Veeam provides dates but no publication times.
• Veeam KB4905 was published on 25 August 2026. The page displays a last-modified date of 24 August 2026, one day before publication, and provides no times.
• Veeam ONE 13 release information was last modified on 26 August 2026 and lists the 25 August cumulative patches and their security fixes. No update time is provided.
• The public record for CVE-2026-65641 was published on 26 August 2026 at 21:21 UTC, after Veeam’s dated advisory first appeared.
• CISA Known Exploited Vulnerabilities catalogue, checked 28 August 2026.
• Microsoft guidance on SMB signing and blocking NTLM for outbound SMB.