T
Threats
Veeam Backup for Microsoft 365 Critical Vulnerabilities
Overview
CVE: CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2025-64394
Severity: Critical
Date: 28 October 2026 (vendor advisory published 27 October 2026)
Veeam has disclosed four vulnerabilities in Veeam Backup for Microsoft 365. The most severe, CVE-2026-106076, is rated Critical (CVSS v4.0 9.0) and requires an authenticated organisation-transfer peer. Successful exploitation can lead to remote code execution as the PostgreSQL service account. Veeam notes that attackers are likely to reverse-engineer patches, so prompt updating is important.
Affected Versions
CVE-2026-106076 and CVE-2026-106077
Affected: Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Fixed: Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102)
Not affected: Not stated by the vendor.
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
CVE-2026-106078 and CVE-2025-64394
Affected: Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds. Veeam states unsupported versions were not tested but are likely affected.
Fixed: Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)
Not affected: Not stated by the vendor.
Source: Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Vulnerability Breakdown
CVE-2026-106076 - SQL injection leading to remote code execution
Severity: Critical
CVSS: 9.0 (CVSS v4.0)
Description: An authenticated organisation-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server.
Impact: Cross-tenant read and write of configuration data, and remote code execution as the PostgreSQL service account.
Conditions: Authenticated organisation-transfer peer access is required.
Notes: Reported through HackerOne.
CVE-2026-106077 - Arbitrary file read
Severity: High
CVSS: 8.3 (CVSS v4.0)
Description: A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server.
Impact: File disclosure with LocalSystem privileges.
Conditions: Veeam Backup for Microsoft 365 Administrator role is required.
Notes: Reported through HackerOne.
CVE-2026-106078 - REST API authentication bypass
Severity: Medium
CVSS: 6.9 (CVSS v4.0)
Description: An unauthenticated attacker can bypass REST API authentication with a forged federation token.
Impact: Responses can be received from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Conditions: No authentication required. Network access to the REST API is needed.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
CVE-2025-64394 - Arbitrary file write during installation
Severity: Medium
CVSS: 4.3 (CVSS v4.0)
Description: A low-privileged local user can write arbitrary files with SYSTEM privileges during installation of Veeam Backup for Microsoft 365.
Impact: Privilege escalation or denial of service.
Conditions: Local access and user interaction are required.
Notes: Fixed in 8.6 Patch 1, not in 8.6 base build.
Mitigation
Upgrade Veeam Backup for Microsoft 365 to version 8.6 Patch 1 (build 8.6.0.5011) to address all four CVEs.
Version 8.6 (build 8.6.0.1102) fixes CVE-2026-106076 and CVE-2026-106077 only. It does not fix CVE-2026-106078 or CVE-2025-64394.
Veeam has not published workarounds in this advisory. Veeam states that unsupported versions are likely affected and should be considered vulnerable.
Summary for IT Teams
Products: Veeam Backup for Microsoft 365
Threat Level: Critical, CVSS 9.0
Action Required: Upgrade to Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) as soon as possible.
Reference
Need Help?
If your organisation needs assistance assessing or patching Veeam Backup for Microsoft 365, the Secure ISS SOC team is ready to help. Please get in touch on 1300 769 460.
