CVE-2026-64632 Overview
CVE-2026-64632 is a credential exposure vulnerability that allows a low-privileged authenticated user to capture the NTLM credentials of the Reporter service account. The flaw is categorized under [CWE-522] Insufficiently Protected Credentials. An attacker who successfully coerces authentication from the Reporter service can relay or crack the captured NTLM hash to escalate privileges within the environment.
Critical Impact
A low-privileged network attacker can capture NTLM credentials belonging to the Reporter service account, enabling credential relay attacks and potential lateral movement within the affected infrastructure.
Affected Products
- Veeam Reporter service (see vendor advisory for affected versions)
- Refer to the Veeam Knowledge Base Article for the authoritative product and version list
Discovery Timeline
- 2026-08-26 - CVE-2026-64632 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-64632
Vulnerability Analysis
The vulnerability enables a low-privileged authenticated user to trigger an outbound authentication from the Reporter service account. When the service authenticates to an attacker-controlled endpoint, the NT LAN Manager (NTLM) challenge-response exchange exposes credential material. The attacker can then relay the authentication to another service or attempt offline cracking of the resulting NetNTLM hash.
Because the Reporter service typically runs with elevated permissions inside the affected environment, capturing its credentials undermines the trust boundary between low-privileged users and privileged service identities. The scope impact reflects this: compromise of the service account can affect systems beyond the initially vulnerable component.
Root Cause
The root cause is insufficient protection of credentials during authentication ([CWE-522]). The Reporter service performs authenticated operations without enforcing controls that prevent an untrusted party from directing that authentication to an attacker-controlled destination. Standard mitigations such as channel binding, mandatory signing, or restricting outbound authentication targets are not adequately applied.
Attack Vector
The attack proceeds over the network and requires only low-privileged authenticated access. An attacker with valid low-privileged credentials induces the Reporter service to authenticate to a host or resource under their control. A rogue Server Message Block (SMB) or HTTP listener on that host captures the NTLM exchange. The attacker then relays the authentication to a target that accepts NTLM, or extracts the challenge and response for offline password recovery.
No working exploit code is publicly linked in the enriched data. Consult the Veeam Knowledge Base Article for authoritative technical details.
Detection Methods for CVE-2026-64632
Indicators of Compromise
- Unexpected outbound SMB or HTTP authentication attempts originating from the Reporter service account to non-domain or previously unseen hosts.
- NTLM authentication events (Windows Event ID 4624 / 4776) referencing the Reporter service account with unusual source workstations.
- Presence of tools such as Responder, Inveigh, or ntlmrelayx artifacts on endpoints where low-privileged users operate.
Detection Strategies
- Correlate authentication logs to identify the Reporter service account authenticating to hosts outside its expected operational scope.
- Alert on NTLM relay indicators, including rapid successive authentications from a single service account to multiple SMB or LDAP targets.
- Monitor for UNC path injection patterns in application inputs that reach the Reporter service.
Monitoring Recommendations
- Enable NTLM auditing (Audit NTLM authentication in this domain) and forward events to a centralized log platform.
- Track outbound SMB (TCP 445) connections from servers hosting the Reporter component and baseline expected destinations.
- Review privileged service account activity daily for anomalous authentication targets or times.
How to Mitigate CVE-2026-64632
Immediate Actions Required
- Apply the fixed release referenced in the Veeam Knowledge Base Article as soon as it is available in your change window.
- Restrict low-privileged user access to any interface that can influence Reporter service authentication targets.
- Rotate the Reporter service account password if capture is suspected or after patching.
Patch Information
Veeam has published remediation guidance in KB4892. Administrators should identify affected versions in their environment and upgrade to the vendor-designated fixed build. Verify service functionality after patching and confirm the Reporter service account remains constrained to least-privilege operations.
Workarounds
- Enforce SMB signing on all servers to reduce the success rate of NTLM relay attacks.
- Enable Extended Protection for Authentication (EPA) on services that accept NTLM, including LDAPS and web endpoints.
- Block outbound SMB (TCP 445) from Reporter service hosts to untrusted networks using host or network firewalls.
- Where feasible, disable NTLM in favor of Kerberos and configure Network security: Restrict NTLM group policies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
