Critical severity · published Oct 27, 2026
CVE-2026-106076
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to…
New
9.0
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Backup for Microsoft 365 · Veeam
8.0 through 8.5.0.1014 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106076
www.veeam.com
https://www.veeam.com/kb4957
More from Backup for Microsoft 365
8.3
CVE-2026-106077
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges
6.9
CVE-2026-106078
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not…
4.3
CVE-2025-64394
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to…