Security readout for executives and security teams
Plain-English summary
An unauthenticated network attacker may cause Veeam ONE to initiate SMB authentication using its service account. This could expose sensitive authentication material and create follow-on risk to connected systems. The supplied data does not identify usable affected versions, so organizations must verify exposure against Veeam’s advisory.
Executive priority
Treat as an urgent validation and remediation item because the reported severity is critical and exploitation requires no authentication. Prioritize internet-adjacent or broadly reachable Veeam ONE deployments. Do not assume exposure solely from the incomplete version data; obtain authoritative applicability and remediation details from Veeam KB4905.
Technical view
CVE-2026-65641 is a network-reachable SMB authentication-coercion issue requiring no privileges or user interaction. It is classified as CWE-288 and scored 9.3 under CVSS 4.0, with high vulnerable-system confidentiality impact and downstream system impact. The source bundle does not establish the exact vulnerable Veeam ONE versions.
Likely exposure
Potential exposure exists where Veeam ONE is network-reachable by untrusted systems and its service can initiate SMB connections. Exact exposure cannot be determined because the supplied version range is recorded as “0” to “0” and the default status is “unaffected.” Confirm applicability through Veeam KB4905.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Its low-complexity, unauthenticated network vector nevertheless warrants urgent assessment. Authentication coercion could support credential-related follow-on attacks, but specific outcomes are not established by the supplied sources.
Researcher notes
The record’s affected-version data is insufficient for reliable matching: it lists versions “0” through “0” while declaring the default status unaffected. Researchers should avoid asserting a concrete vulnerable range without the vendor advisory. No active exploitation, public exploit, patch version, or specific relay outcome is established in the supplied bundle.
Mitigation direction
- Review Veeam KB4905 for affected versions, patches, and vendor-approved mitigations.
- Apply the vendor-prescribed remediation after confirming product and version applicability.
- Restrict unnecessary SMB traffic between Veeam ONE systems and untrusted networks.
- Review and minimize privileges assigned to the Veeam ONE service account.
- Rotate service-account credentials if investigation identifies suspicious authentication activity.
Validation and detection
- Inventory all Veeam ONE deployments and record their exact installed versions.
- Compare each version and configuration with the applicability details in Veeam KB4905.
- Verify network controls restrict unnecessary inbound and outbound SMB connectivity.
- Review authentication and network logs for unexpected SMB activity involving the service account.
- Confirm the vendor-prescribed remediation is installed and operational on applicable systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-65641 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L——hackeroneVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.veeam.com/kb4905CVE reference, hackerone
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.