Veeam ONE CVE-2026-64632

Exploitation requires a valid low-privileged account in the Veeam ONE environment, as confirmed by PR:L in the CVSS 4.0 vector; unauthenticated external attackers cannot directly exploit this vulnerability. The attack is network-accessible (AV:N) with no additional platform or configuration requirements specified (AT:N) and requires no victim interaction (UI:N). The specific Veeam ONE feature or endpoint through which NTLM coercion is triggered - whether a reporting API, scheduled job configuration, or administrative interface - is not identified in the available description, and this detail should be confirmed in the vendor advisory. Exploitation is bounded by the requirement for a Veeam ONE account; however, in enterprise deployments where Veeam ONE access is granted broadly for reporting purposes, this is a wide boundary.

The CVSS 4.0 score of 8.5 accurately reflects a serious real-world risk profile: network-accessible (AV:N), low complexity (AC:L), no attack requirements (AT:N), low privileges required (PR:L), and no user interaction (UI:N) combine to make this broadly exploitable by any authenticated Veeam ONE user. The high subsequent-system impact (SC:H/SI:H/SA:H) is the most significant signal - the Reporter service account is expected to hold elevated privileges across managed backup infrastructure, meaning credential theft cascades well beyond Veeam ONE itself. No EPSS data was supplied, and neither a public exploit nor a CISA KEV listing is confirmed, which are important gaps; however, the absence of KEV listing should not reduce urgency, as service account credential theft in backup management platforms is a known ransomware precursor technique. The low privilege requirement means any employee or contractor with a Veeam ONE login is a potential attacker, substantially widening the threat surface relative to vulnerabilities requiring administrative access.

An attacker with a valid low-privileged Veeam ONE account sends a crafted network request - such as a UNC path or API call - that coerces the Reporter service account to perform an NTLM authentication handshake against an attacker-controlled SMB listener. The attacker captures the resulting Net-NTLMv2 hash, then either cracks it offline or relays it to authenticate against other Windows systems in the environment, potentially gaining access to backup storage, domain controllers, or other infrastructure the Reporter service account can reach. No confirmed public exploit code exists at time of analysis, but the underlying coerced-authentication technique is implemented in widely available offensive tooling.