Loading story…
Veeam has patched CVE-2026-65641, a critical (CVSS 9.3) unauthenticated network vulnerability in Veeam ONE 13 that can coerce SMB authentication attempts from the Veeam ONE service account. Attackers could capture Net-NTLM material for offline cracking or relay it to other services, creating a path to lateral movement and compromise of privileged backup infrastructure. Affected releases include Veeam ONE 13.1.0.7034 and earlier 13.x builds; legacy 12.x versions are not affected.
The fix is available in Veeam ONE 13.1 Patch 0 build 13.1.0.7233 and Veeam ONE 13.0.2 Patch 1 build 13.0.2.7159, detailed in advisory KB4905. Veeam also addressed a separate medium-severity issue in Veeam Backup & Replication that can write Application-Aware Processing guest OS credentials in cleartext to guest-machine logs. Neither issue is known to be exploited or has a public proof of concept; organizations should deploy the updates, restrict outbound SMB, harden systems against NTLM relay, and minimize privileges assigned to the Veeam ONE service account.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Veeam released KB4902 fixes for a medium-severity Veeam Backup & Replication vulnerability that could write Application-Aware Processing guest OS credentials in cleartext logs on guest machines. The issue affected version 13 builds through 13.0.2.29 and was remediated in builds 13.1.0.411 and 13.0.3.63.
Veeam published KB4905 and released fixes for CVE-2026-65641, a CVSS 9.3 unauthenticated SMB authentication-coercion flaw affecting Veeam ONE version 13 builds through 13.1.0.7034. The flaw was fixed in builds 13.1.0.7233 and 13.0.2.7159; Veeam stated it had been reported through HackerOne and had no confirmed in-the-wild exploitation or public proof of concept.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceheise.de
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veeam released security updates for multiple products, led by a **critical authentication bypass** in **Veeam Backup Enterprise Manager** tracked as `CVE-2024-29849`. The flaw allows an unauthenticated attacker to log in as any user, including an administrator, by supplying a forged VMware SSO token to the REST API service on TCP port `9398`. Veeam also addressed related Enterprise Manager issues including `CVE-2024-29850`, which can enable account takeover through **NTLM relay**, `CVE-2024-29851`, which can expose the NTLM hash of the Enterprise Manager service account, and `CVE-2024-29852`. The updates extend beyond Enterprise Manager. Veeam patched **Backup & Replication**, **Veeam Agent for Windows**, and **Veeam Service Provider Console**, including `CVE-2024-29212`, a critical remote code execution flaw in Service Provider Console, and `CVE-2024-29853`, a local privilege escalation issue in Agent for Windows. Veeam advised organizations to upgrade immediately, including moving Backup & Replication to at least **12.1.2.172** and Veeam Agent for Windows to at least **6.1.2**; where Enterprise Manager cannot be patched promptly, the company recommended stopping the Backup Enterprise Manager service as a temporary mitigation.
Aug 1, 2026
Veeam released security updates for multiple products, including **Backup & Replication**, **Service Provider Console**, **Veeam ONE**, **Agent for Linux**, and several backup plug-ins, to fix a set of critical and high-severity vulnerabilities. The most severe issue, **`CVE-2024-40711`**, is a critical unauthenticated remote code execution flaw in **Veeam Backup & Replication** with a **CVSS 9.8** rating, allowing attackers to potentially compromise backup servers without logging in. The broader patch set also addresses weaknesses that could enable credential theft, backup manipulation, MFA bypass, privilege escalation, SSRF exploitation, and additional remote code execution in other Veeam components. Security advisories urged organizations to upgrade immediately to fixed versions, warning that backup infrastructure is a high-value target and that successful exploitation could materially increase ransomware risk by giving attackers access to recovery systems.
Jul 24, 2026
Veeam released security updates for multiple products after disclosing several vulnerabilities that affect enterprise backup and monitoring environments, including **Veeam Backup & Replication**, **Veeam ONE**, and **Veeam Service Provider Console**. The most severe issue, **`CVE-2026-32998`**, is a critical remote code execution flaw in Veeam Service Provider Console with a **CVSS score of 9.4**; Veeam said it is fixed in **version `9.2.1.33875`**. Canadian Centre for Cyber Security advisory **AV26-513** said affected versions include Veeam Backup & Replication 13 releases before **`13.0.2.29`**, Veeam ONE releases before **`13.0.2.6723`**, and Veeam Service Provider Console 9.2 releases before **`9.2.1.33875`**, and urged administrators to apply the vendor updates. Veeam also patched **`CVE-2026-32996`**, a high-severity local privilege escalation flaw in **Veeam Agent for Microsoft Windows** that could let a low-privileged local user gain administrative control, and **`CVE-2026-32997`**, an arbitrary file write issue affecting Linux-based backup servers running the **Veeam Software Appliance** that could allow an authenticated backup administrator to modify system files. For organizations unable to patch immediately, Veeam provided a workaround for the Service Provider Console bug by disabling the `AlarmManagement_ScriptExecution` setting in the local configuration JSON file, while older reporting on **Veeam ONE** underscores the continued security focus on Veeam’s management stack.
Jun 29, 2026