Back Secure-Iss Veeam Backup for Microsoft 365 Critical Vulnerabilities
Veeam has disclosed four vulnerabilities in Veeam Backup for Microsoft 365. The most severe, CVE-2026-106076, is rated Critical (CVSS v4.0 9.0) and requires an authenticated organisation-transfer peer. Successful exploitation can lead to remote code execution as the PostgreSQL service account. Veeam notes that attackers are likely to reverse-engineer patches, so prompt updating is important.
CVE-2026-106076 and CVE-2026-106077
Affected: Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Affected: Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Fixed: Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102)
Fixed: Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102)
Not affected: Not stated by the vendor.
Not affected: Not stated by the vendor.
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
CVE-2026-106078 and CVE-2025-64394
Affected: Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Affected: Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Fixed: Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)
Fixed: Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)
Not affected: Not stated by the vendor.
Not affected: Not stated by the vendor.
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Vulnerability Breakdown
CVE-2026-106076 - SQL injection leading to remote code execution
CVSS: 9.0 (CVSS v4.0)
CVSS: 9.0 (CVSS v4.0)
Description: An authenticated organisation-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server.
Description: An authenticated organisation-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server.
Impact: Cross-tenant read and write of configuration data, and remote code execution as the PostgreSQL service account.
Impact: Cross-tenant read and write of configuration data, and remote code execution as the PostgreSQL service account.
Conditions: Authenticated organisation-transfer peer access is required.
Conditions: Authenticated organisation-transfer peer access is required.
Notes: Reported through HackerOne.
Notes: Reported through HackerOne.
CVE-2026-106077 - Arbitrary file read
CVSS: 8.3 (CVSS v4.0)
CVSS: 8.3 (CVSS v4.0)
Description: A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server.
Description: A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server.
Impact: File disclosure with LocalSystem privileges.
Impact: File disclosure with LocalSystem privileges.
Conditions: Veeam Backup for Microsoft 365 Administrator role is required.
Conditions: Veeam Backup for Microsoft 365 Administrator role is required.
Notes: Reported through HackerOne.
Notes: Reported through HackerOne.
CVE-2026-106078 - REST API authentication bypass
CVSS: 6.9 (CVSS v4.0)
CVSS: 6.9 (CVSS v4.0)
Description: An unauthenticated attacker can bypass REST API authentication with a forged federation token.
Description: An unauthenticated attacker can bypass REST API authentication with a forged federation token.
Impact: Responses can be received from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Impact: Responses can be received from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Conditions: No authentication required. Network access to the REST API is needed.
Conditions: No authentication required. Network access to the REST API is needed.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
CVE-2025-64394 - Arbitrary file write during installation
CVSS: 4.3 (CVSS v4.0)
CVSS: 4.3 (CVSS v4.0)
Description: A low-privileged local user can write arbitrary files with SYSTEM privileges during installation of Veeam Backup for Microsoft 365.
Description: A low-privileged local user can write arbitrary files with SYSTEM privileges during installation of Veeam Backup for Microsoft 365.
Impact: Privilege escalation or denial of service.
Impact: Privilege escalation or denial of service.
Conditions: Local access and user interaction are required.
Conditions: Local access and user interaction are required.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
Upgrade Veeam Backup for Microsoft 365 to version 8.6 Patch 1 (build 8.6.0.5011) to address all four CVEs.
Upgrade Veeam Backup for Microsoft 365 to version 8.6 Patch 1 (build 8.6.0.5011) to address all four CVEs.
Version 8.6 (build 8.6.0.1102) fixes CVE-2026-106076 and CVE-2026-106077 only. It does not fix CVE-2026-106078 or CVE-2025-64394.
Version 8.6 (build 8.6.0.1102) fixes CVE-2026-106076 and CVE-2026-106077 only. It does not fix CVE-2026-106078 or CVE-2025-64394.
Veeam has not published workarounds in this advisory. Veeam states that unsupported versions are likely affected and should be considered vulnerable.
Veeam has not published workarounds in this advisory. Veeam states that unsupported versions are likely affected and should be considered vulnerable.
Products: Veeam Backup for Microsoft 365
Products: Veeam Backup for Microsoft 365
Threat Level: Critical, CVSS 9.0
Threat Level: Critical, CVSS 9.0
Action Required: Upgrade to Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) as soon as possible.
Action Required: Upgrade to Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) as soon as possible.
Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
If your organisation needs assistance assessing or patching Veeam Backup for Microsoft 365, the Secure ISS SOC team is ready to help. Please get in touch on 1300 769 460.
Australia is secure when Australian talent defends it.
Reach out today to how with Lumara, we can work together to protect your business from the always changing Australian threat landscape.
Australia is secure when Australian talent defends it.
Reach out today to how with Lumara, we can work together to protect your business from the always changing Australian threat landscape.
Australia is secure when Australian talent defends it.
Reach out today to how with Lumara, we can work together to protect your business from the always changing Australian threat landscape.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
