CVE-2026-64632: CWE-522 Insufficiently Protected Credentials in Veeam ONE

This vulnerability in Veeam ONE involves insufficient protection of credentials, specifically allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. The CVSS 4.0 score is 8.5, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-64632 but lacks vendor-provided remediation or patch information at this time.

An attacker with low privileges can capture NTLM credentials of a service account, potentially enabling further unauthorized access or lateral movement within the affected environment. The high CVSS score reflects significant confidentiality, integrity, and availability impacts if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system to trusted users only and monitor for unusual activity related to the Reporter service account credentials.