CVE-2026-65641: SMB Authentication Bypass Vulnerability

CVE-2026-65641 Overview

CVE-2026-65641 is an authentication coercion vulnerability that allows an unauthenticated network attacker to force a Veeam service account to initiate Server Message Block (SMB) authentication to an attacker-controlled endpoint. The flaw is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). An attacker positioned on the network can capture the resulting NTLM authentication material or relay it to a target service to gain unauthorized access. Veeam has published a Knowledge Base Article detailing the issue and remediation guidance.

Critical Impact
An unauthenticated attacker with network access can coerce SMB authentication from a privileged service account, enabling NTLM relay attacks and lateral movement across the environment.

Affected Products

Veeam products referenced in the vendor advisory
Systems where the affected Veeam service account holds elevated privileges
Environments where SMB and NTLM authentication remain enabled

Discovery Timeline

2026-08-26 - CVE-2026-65641 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-65641

Vulnerability Analysis

CVE-2026-65641 stems from an alternate authentication path that an unauthenticated remote attacker can trigger. The attacker induces the Veeam service to reach out over SMB to a host they control. When the service connects, it presents NTLM credentials belonging to the service account.

Authentication coercion vulnerabilities of this class enable two primary follow-on attacks. First, attackers can capture NTLMv2 hashes and attempt offline password recovery. Second, and more damaging, attackers can relay the authentication in real time to another service that accepts NTLM, such as Active Directory Certificate Services or LDAP.

Because the coercion targets a service account, the harvested credentials frequently carry broad rights across backup infrastructure, hypervisors, and domain resources.

Root Cause

The root cause is an exposed code path that accepts attacker-supplied UNC paths or network identifiers without adequate authentication or destination validation. The service subsequently performs an outbound SMB connection using its own account context, satisfying the pattern described in CWE-288.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the vulnerable endpoint that references a UNC path pointing to a listener under their control, such as an SMB responder or NTLM relay tool. The Veeam service then authenticates to that endpoint, exposing the credentials. Technical specifics are described in the Veeam Knowledge Base Article.

Detection Methods for CVE-2026-65641

Indicators of Compromise

Outbound SMB (TCP/445) connections from Veeam servers to unexpected internal or external hosts
NTLM authentication events (Windows Event ID 4624/4648) originating from Veeam service accounts to unfamiliar destinations
Presence of known SMB responder or NTLM relay tool signatures on the network segment hosting Veeam infrastructure
Anomalous traffic patterns from Veeam management interfaces to attacker-controlled infrastructure

Detection Strategies

Baseline expected SMB destinations for Veeam service accounts and alert on deviations
Inspect network traffic for SMB negotiation packets sourced from backup infrastructure to non-approved endpoints
Correlate authentication logs with process telemetry on Veeam hosts to identify coerced outbound authentications
Hunt for LDAP or AD CS enrollment activity following an outbound SMB authentication attempt from the Veeam service account

Monitoring Recommendations

Enable NTLM auditing on domain controllers and forward events to a central log store
Monitor Veeam application logs for external UNC path parameters supplied through unauthenticated interfaces
Alert on any use of SMB signing failures involving service accounts associated with backup operations

How to Mitigate CVE-2026-65641

Immediate Actions Required

Apply the vendor-provided fix documented in the Veeam Knowledge Base Article as soon as it is available for your version
Restrict outbound SMB (TCP/445) from Veeam servers to only required internal destinations
Reduce the privileges assigned to Veeam service accounts to the minimum required for backup operations
Rotate credentials for Veeam service accounts if coercion activity is suspected

Patch Information

Veeam has published remediation guidance in KB4905. Administrators should review the advisory for fixed product versions and configuration changes required to fully mitigate the issue.

Workarounds

Enforce SMB signing and Extended Protection for Authentication (EPA) on services that accept NTLM to blunt relay attacks
Disable NTLM where feasible and require Kerberos authentication for service accounts
Segment Veeam infrastructure so that management interfaces are not reachable from general-purpose user networks
Block egress SMB traffic at perimeter and internal firewalls to prevent authentication to attacker-controlled hosts

bash

# Configuration example: block outbound SMB from a Veeam host using Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 445 \
  -Action Block \
  -Profile Any