Description
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
Published: 2026-08-26
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Theft
Action: Patch
AI Analysis

Impact

A local low‑privileged user can capture the NTLM credentials of the Reporter service account. With those credentials the attacker can impersonate the service account, potentially escalating privileges or accessing protected resources. The weakness corresponds to Information Exposure (CWE‑522).

Affected Systems

The vulnerability affects Veeam ONE, with no specific version information provided. All current releases of Veeam ONE are potentially vulnerable until patches are applied.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, but the high CVSS suggests a serious risk. The weakness is exploitable by a local user with standard privileges; there is no indication of a remote attack vector. Consequently, attackers need local access but can use the captured credentials to impersonate the Reporter service account.

Generated by OpenCVE AI on August 26, 2026 at 23:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Veeam ONE security update that fixes the credential‑capture issue.
  • Limit the Reporter service account to the least privileges necessary for its function and ensure its password is strong and changed regularly.
  • Disable NTLM authentication where feasible and enforce encrypted authentication mechanisms.
  • Enable auditing and monitor logs for suspicious authentication attempts involving the Reporter service account.

Generated by OpenCVE AI on August 26, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.veeam.com/kb4892 cve-icon cve-icon
History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Veeam
Veeam one
Vendors & Products Veeam
Veeam one

Wed, 26 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title NTLM Credential Capture by Low-privileged User in Veeam ONE

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
Weaknesses CWE-522
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

Veeam One
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-08-27T15:04:10.844Z

Reserved: 2026-07-20T15:00:00.696Z

Link: CVE-2026-64632

cve-icon Vulnrichment

Updated: 2026-08-27T14:56:13.238Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-26T22:16:25.617

Modified: 2026-09-03T17:02:54.670

Link: CVE-2026-64632

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T00:30:13Z

Weaknesses
  • CWE-522

    Insufficiently Protected Credentials