High severity · published Oct 27, 2026
CVE-2026-106077
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges
New
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Backup for Microsoft 365 · Veeam
8.0 through 8.5.0.1014 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106077
www.veeam.com
https://www.veeam.com/kb4957
More from Backup for Microsoft 365
9.0
CVE-2026-106076
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to…
6.9
CVE-2026-106078
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not…
4.3
CVE-2025-64394
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to…