cyfenced.com →

[ CVE-2026-106076 · Published 27 Oct 2026 ]

Vulnerability in Veeam Backup for Microsoft 365

CVSS 9.0 EPSS <1%3 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.0

[ Description ]Official description

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1411

    Multiple vulnerabilities in Veeam Backup for Microsoft 365 Translated from French

    Multiple vulnerabilities have been discovered in Veeam Backup for Microsoft 365. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2025-64394CVE-2026-106077CVE-2026-106076+1 more CVEs
  • CERT-FRCERTFR-2026-AVI-1399

    Multiple vulnerabilities in Veeam products Translated from French

    Multiple vulnerabilities have been discovered in Veeam products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2026-108142CVE-2025-64394CVE-2026-106077+6 more CVEs
  • BSI CERT-BundWID-SEC-2026-4217

    Veeam Backup for Microsoft 365: Multiple vulnerabilities Translated from German

    CVE-2026-106076CVE-2025-64394CVE-2026-106078+1 more CVEs

[ References ]References