Critical severity · published Oct 27, 2026
CVE-2026-106076
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to…
New
9.0
CVSS
–
EPSS
No
On KEV
Description
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Backup for Microsoft 365 · Veeam
8.0 through 8.5.0.1014 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106076
www.veeam.com
https://www.veeam.com/kb4957
More from Backup for Microsoft 365
8.3
CVE-2026-106077
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges
6.9
CVE-2026-106078
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not…
4.3
CVE-2025-64394
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to…