www.veeam.com Critical Vulnerabilities Found in Veeam Backup for Microsoft 365
Article Content
- •CVE-2026-106076 is a critical SQL injection vulnerability allowing remote code execution.
- •CVE-2026-106077 enables arbitrary file reading for users with admin roles.
- •Patches are available in Veeam Backup for Microsoft 365 version 8.6 and Patch 1.
Veeam disclosed four vulnerabilities in Veeam Backup for Microsoft 365, with the most severe being CVE-2026-106076, rated Critical (CVSS 9.0). This vulnerability allows an authenticated organization-transfer peer to perform SQL injection, leading to remote code execution as the PostgreSQL service account. CVE-2026-106077, rated High (CVSS 8.3), enables a user with administrator rights to read arbitrary files on the backup server. Both vulnerabilities affect Veeam Backup for Microsoft 365 version 8.5.0.1014 and earlier, while CVE-2026-106078 and CVE-2025-64394 impact version 8.6.0.1102 and earlier. Veeam has released patches for these vulnerabilities, with the critical one fixed in version 8.6 (build 8.6.0.1102) and the high one in Patch 1 (build 8.6.0.5011). Organizations are urged to update promptly due to the potential for attackers to reverse-engineer patches.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2025-64394 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
What is the severity of the vulnerabilities?
What should organizations do?
Continue Reading
China-linked Hackers Exploit PHP2Shell to Compromise 25 Firewalls A China-linked threat actor has exploited vulnerabilities in PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Fragnesia privilege escalation bug (CVE-2026-46300) to gain root access to 25 firewalls, including those in an U.S. The attackers identified vulnerable systems using the FOFA search engine and executed…