ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Veeam ONE

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

Veeam Released Patches for Critical Vulnerability (CVE-2026-65641)

Veeam patched critical CVE-2026-65641 (CVSS 9.3) in Veeam ONE, exploitable by unauthenticated network attackers to coerce SMB authentication from the service account.

Veeam released patches for its Veeam ONE monitoring, reporting, and capacity planning software addressing CVE-2026-65641, rated critical with a CVSS score of 9.3. Successful exploitation allows an unauthenticated network attacker to coerce SMB authentication from the Veeam ONE service account, creating relay-style attack opportunities. Qualys ThreatPROTECT relayed the vendor advisory; administrators should apply the patches promptly. No in-the-wild exploitation is noted in the advisory.

Qualys ThreatPROTECT · 15d agoVulnerabilityCVE-2026-65641

Veeam security advisory (AV26-855)

Canada's Cyber Centre advisory AV26-855 says Veeam Backup & Replication and Veeam ONE vulnerabilities are resolved in 13.0.3 and 13.1 updates.

Advisory AV26-855, dated August 27, 2026, states that as of August 25 Veeam is affected by vulnerabilities in Backup & Replication (prior to 13.0.3 build 13.0.3.63 and prior to 13.1 build 13.1.0.411) and Veeam ONE (prior to or equal to 13.0.2.6723 and 13.1.0.7034). Fixes are documented in KB4902 (Veeam Backup & Replication 13.1) and KB4905 (Veeam ONE 13.1 Patch 0). The Cyber Centre urges users and administrators to apply the available updates. No CVE identifiers or exploitation details are given.

Canadian Centre for Cyber Security · 19d agoAdvisory

Related CVEs

  • CVE-2026-656419.3<1%
    Unauthenticated SMB Authentication Coercion in Veeam Software
    CVE-2026-65641 is a critical (CVSS 4.0: 9.3) flaw, categorized as an authentication bypass (CWE-288), that lets an unauthenticated network attacker induce the affected Veeam product's service account to authenticate over SMB to an attacker-controlled host. The attack is triggered by network requests to the vulnerable service with no credentials, privileges, or user interaction required, per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N). Successful coercion exposes the service account's SMB/NTLM authentication to capture or relay, yielding high confidentiality impact on the vulnerable system and on subsequent systems that the service account can reach. Organizations running the affected Veeam software are exposed primarily to network-adjacent attackers; Veeam has released patches, though the specific product and version range are not stated in the available data. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a ~0.5% probability of exploitation within 30 days.
    · Veeamlarge

Appears with

vendor Veeam 2organization Canadian Centre for Cyber Security 1organization Qualys 1organization Veeam 1product Veeam Backup & Replication 1vendor Qualys 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.