External risk intelligence

Unauthenticated SMB Authentication Coercion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65641

The vulnerability involves coercing SMB authentication. While the attack vector is network-based, SMB is a protocol typically restricted to internal network segments and is rarely exposed directly to the public internet in common deployments. Exposure usually requires misconfiguration or tunneling.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified that could allow an unauthenticated attacker to exploit the SMB protocol. This flaw could potentially be used to coerce authentication from service accounts, impacting systems that utilize this protocol. The main concern at this time is to confirm if our environment uses this specific technology and if it is exposed in a way that could be relevant.

Unauthenticated attacker can force authentication.
This could impact our systems and data.
Confirm relevance and exposure; assess risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network could trick the service account into authenticating to the attacker's system. This occurs when the service interacts with SMB, a file-sharing protocol.

No prior access needed.
Service sends SMB credentials.
Potential for unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated network attacker could coerce SMB authentication from a service account. This may expose system data or user data to unauthorized access when supported by the advisory.

System credentials and data could be affected.
Attacker could coerce authentication over the network.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, which allows an unauthenticated network attacker to coerce SMB authentication from a service account, requires immediate attention from infrastructure and security teams. The first practical step is to identify all instances of the affected technology, determine their exposure to the network, confirm business criticality, and then assign ownership for remediation planning.

Infrastructure and Security teams own.
Verify SMB service exposure and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the technology affected by CVE-2026-65641?

This vulnerability affects software utilizing the Server Message Block (SMB) protocol, a standard technology used for file sharing, printer access, and inter-process communication across network environments. When service accounts interact with these SMB functions, they may become susceptible to the authentication coercion issues described in this advisory.

What does this SMB authentication coercion mean?

This vulnerability falls under CWE-288, which involves improper authentication. In this context, it means an attacker can trick a service account into sending its credentials to an attacker-controlled destination. Because the system is 'coerced' into authenticating, it essentially provides the attacker with a path to access sensitive information or potentially perform actions as that service account.

How does an attacker trigger CVE-2026-65641?

An attacker triggers this by sending specially crafted network requests that force the targeted service account to initiate an SMB connection to a system the attacker controls. Importantly, this does not require the attacker to have prior access to the system or the account. However, the attack does not occur if the service account does not interact with the specific SMB operations that the vulnerability targets.

Do I need to worry if my systems are not internet-facing?

Halo Surface Signal indicates that while this is a network-based vulnerability, the likelihood of successful exploitation is often lower for internal systems because SMB is typically restricted to local network segments. Direct exposure to the public internet is rare and usually stems from misconfigurations or tunneling, which would significantly increase the risk profile compared to an internal-only deployment.

What is the first step to address this CVE?

Begin by auditing your infrastructure to locate all instances where the affected service accounts utilize SMB. Once identified, verify whether these services are reachable across the network, particularly if they are exposed beyond internal segments. After confirming the scope and business criticality of these services, coordinate with your technical teams to prioritize remediation and formalize an ownership plan.

References

www.veeam.com/kb4905

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.