Back www.veeam.com

KB4905: Vulnerability Resolved in Veeam ONE 13.1 Patch 0

www.veeam.com • August 27, 2026

Share: View original

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong. Please, try again later.

Please, try again later.

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

Severity: Critical CVSS v4.0 Score: 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L Source: Reported through HackerOne.

This vulnerability was fixed starting in the following builds:

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Your feedback has been received and will be reviewed.

Please, try again later.

Please try select less .

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

Your feedback has been received and will be reviewed.

Oops! Something went wrong. Please, try again later.

Please, try again later.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Veeam ONE Vulnerability Allows SMB Authentication Coercion A critical vulnerability in Veeam ONE, tracked as CVE-2026-65641, has been disclosed, allowing unauthenticated network attackers to coerce SMB authentication from the service account running the affected service. This vulnerability has been assigned a CVSS v4.0 score of 9.3, indicating its high severity. Veeam released security updates to address this issue, which was reported through HackerOne. Organizations using Veeam ONE are urged to apply the necessary patches to mitigate potential exploitation. The vulnerability was published in the knowledge base on August 26, 2026, and is currently being monitored for any signs of active exploitation. Failure to address this vulnerability could lead to unauthorized access and potential data breaches. 1 sources 61

Extracted Entities

KB4905: Vulnerability Resolved in Veeam ONE 13.1 Patch 0

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)