Veeam ONE CVE-2026-65641

Exploitation requires network access to the Veeam ONE service endpoint that can be induced to perform outbound SMB authentication, plus an attacker-controlled SMB destination (rogue listener) to capture the coerced service-account authentication - no credentials or user interaction are needed (PR:N/UI:N/AT:N). The high-impact outcome (SC:H) is limited by the environment: to convert captured NTLM into access the attacker needs reachable relay targets that do not enforce SMB signing or EPA, and the value of the leak scales with how privileged the Veeam ONE service account is. Outbound SMB (445) from the Veeam ONE host reaching an attacker endpoint is therefore a practical prerequisite for weaponization.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a genuinely easy remote, unauthenticated, no-interaction trigger, and the score of 9.3 is driven by VC:H plus subsequent-system impact SC:H - reflecting that the real damage is credential capture and lateral movement, not local compromise of Veeam ONE. VI:L/VA:N indicate limited direct integrity impact and no availability impact on the vulnerable system. No EPSS score, KEV entry, or POC was provided, so the exploitation-probability and in-the-wild signals are simply absent rather than low - this should be treated as a high-priority patch based on ease of exploitation and the privileged nature of Veeam service accounts, while acknowledging that real-world weaponization depends on the surrounding AD environment (whether reachable relay targets lack SMB signing). The tag 'Information Disclosure' is consistent with a credential-coercion primitive rather than direct RCE.

An attacker with only network reachability to the Veeam ONE service stands up a rogue SMB listener, then sends the crafted request that coerces the Veeam ONE service account to authenticate outbound to that listener, capturing its NTLM authentication. The attacker relays or cracks the captured credential to access other domain systems that lack SMB signing. No public POC was provided, but the low attack complexity (AC:L) and no-privilege/no-interaction requirements make the trigger straightforward.