Medium severity · published Oct 27, 2026
CVE-2026-106078
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not…
New
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Backup for Microsoft 365 · Veeam
8.0 through 8.6.0.1102 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106078
www.veeam.com
https://www.veeam.com/kb4957
More from Backup for Microsoft 365
9.0
CVE-2026-106076
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to…
8.3
CVE-2026-106077
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges
4.3
CVE-2025-64394
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to…