Vulnerability in Veeam Management Pack for Microsoft System Center

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.3

[ Description ]Official description

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

[ Fixes ]Fixes and patches

• Security bulletin: Veeam kb4961Vendor patch or bulletin · CERT-FR · veeam.com/kb4961, cited by CERT-FR CERTFR-2026-AVI-1426

[ Advisories ]Government CERT advisories

• CERT-FR30 Oct 2026CERTFR-2026-AVI-1426

  Multiple vulnerabilities in Veeam Management Pack Translated from French

  Multiple vulnerabilities have been discovered in Veeam Management Pack. They allow an attacker to cause remote arbitrary code execution.

  CVE-2026-107238CVE-2026-107239CVE-2023-22793
• BSI CERT-Bund29 Oct 2026WID-SEC-2026-4249

  Veeam Management Pack for System Center: Multiple vulnerabilities allow code execution Translated from German

  CVE-2026-107238CVE-2023-22793CVE-2026-107239

[ References ]References

• www.veeam.com/kb4961