CVE-2026-65641: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Veeam One

This vulnerability in Veeam One enables an unauthenticated network attacker to bypass authentication mechanisms by coercing SMB authentication from the service account. It is categorized as CWE-288, which involves authentication bypass through an alternate path or channel. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high impact on confidentiality and security scope changes. The vulnerability is published and reserved under CVE-2026-65641 but lacks vendor remediation details or affected version specifics.

An unauthenticated attacker can coerce SMB authentication from the service account, potentially leading to unauthorized access or lateral movement within the affected environment. The critical CVSS score (9.3) indicates a high impact on confidentiality and security scope, with low complexity and no required privileges or user interaction, making exploitation potentially severe if leveraged.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Until a patch is released, monitor vendor communications for updates and consider network-level controls to restrict SMB traffic to and from the Veeam One service.