Veeam ONE SMB Authentication Coercion CVE-2026-65641: Ransomware Foothold Against Backups

Veeam's August advisory discloses CVE-2026-65641 (CVSS v4.0 9.3): an unauthenticated network attacker can coerce SMB authentication from the Veeam ONE service account. If SMB signing is not required, the attacker can relay that auth to a domain controller and seize full domain control. Highly destructive against enterprise backup systems; ransomware crews use this pattern to wipe backups before deploying encryptors.

Incident overview

Veeam disclosed a high-severity Veeam ONE monitoring-service bug, CVE-2026-65641, in its 27 August 2026 monthly security advisory. CVSS v4.0: 9.3. An unauthenticated network attacker can coerce SMB authentication from the service account that runs Veeam ONE. If SMB signing is not required in the target environment, the attacker can relay the coerced credentials to a domain controller or use NTLM relay and obtain full Active Directory control.

Veeam ONE sits in backup-admin core infrastructure. It monitors every Veeam Backup & Replication job, reports capacity, and raises alerts. Compromise the service and the attacker can move into backup and restore without going deep into production, then destroy or encrypt protected data. Matches the standard ransomware play: wipe backups, then drop the encryptor.

Technical details

CVE-2026-65641 preconditions:

• Veeam ONE runs as an account with domain privileges (common in deployments);
• Veeam ONE is listening on the default SMB port;
• Domain clients, domain controllers, and the path between them do not require SMB signing (`Require SMB Signing = Enabled` is off by default).

Attacker sends a crafted RPC call so the Veeam ONE service connects, with its service credentials, to an attacker-controlled SMB server. From there the attacker can:

• NTLM Relay (e.g. impacket `ntlmrelayx`) the auth to LDAP or SMB;
• Reach unauthorized auth via known coercion paths: PetitPotam, PrinterBug, DFSCoerce;
• With the session: enumerate domain objects, write ACLs, request service tickets, escalate to Domain Admin.

CVSS 4.0 vector AV:N + AC:L + AT:N + PR:N + UI:N: no privileges, no user interaction, low attack complexity. Mass-scan material for ransomware crews.

Impact

• All Veeam ONE deployments older than 12.3.x (including 12.0 / 11.x / 10.x) with SMB access enabled;
• Veeam ONE bundled with Veeam Backup & Replication 12.x, and standalone installs;
• Finance, healthcare, carriers, manufacturing—any org using Veeam to protect VMware/Hyper-V backups;
• SMB signing enforcement and Microsoft network client policy depend on DC GPOs; unsigned SMB expands the attack surface.

Remediation

• Upgrade Veeam ONE immediately to the official fixed build (every version marked Vulnerable in the August 2026 advisory). Update Veeam Backup & Replication in lockstep;
• Force SMB signing via GPO on Active Directory DCs: Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options → `Microsoft network server: Digitally sign communications (always) = Enabled`;
• Disable `NTLMv1` in NTLM settings. Monitor NTLM auditing for coerced auth in `Event 4624/4625/4776`;
• Remove the Veeam ONE service account from Domain Admins. Run it as a GMSA (Group Managed Service Account) with least privilege;
• Do not expose the Veeam ONE Web UI (default 1239/TCP) on the public internet. VPN or jump host only;
• Add IDS/IPS signatures for PrinterBug, PetitPotam, and DFSCoerce-class coercion calls. Allowlist SMB destinations for the Veeam ONE service account.

References

• Veeam KB4693: CVE-2026-65641 official advisory
• NVD: CVE-2026-65641 detail page
• Enigma Global Daily Digest 2026-08-28
• GBHackers: CVE-2026-65641 forced SMB authentication analysis
• Microsoft: SMB signing policy deployment docs