cyfenced.com →

[ CVE-2026-106078 · Published 27 Oct 2026 ]

Vulnerability in Veeam Backup for Microsoft 365

CVSS 6.9 EPSS <1%3 agency advisoriesFix available

[ Description ]Official description

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1411

    Multiple vulnerabilities in Veeam Backup for Microsoft 365 Translated from French

    Multiple vulnerabilities have been discovered in Veeam Backup for Microsoft 365. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2025-64394CVE-2026-106077CVE-2026-106076+1 more CVEs
  • CERT-FRCERTFR-2026-AVI-1399

    Multiple vulnerabilities in Veeam products Translated from French

    Multiple vulnerabilities have been discovered in Veeam products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2026-108142CVE-2025-64394CVE-2026-106077+6 more CVEs
  • BSI CERT-BundWID-SEC-2026-4217

    Veeam Backup for Microsoft 365: Multiple vulnerabilities Translated from German

    CVE-2026-106076CVE-2025-64394CVE-2026-106078+1 more CVEs

[ References ]References