CVE-2026-106076
CriticalCVSS 9.0Summary
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Risk Assessment
An attacker with organization-transfer peer privileges could read and modify configuration data of other tenants and execute arbitrary code as the PostgreSQL service account. The risk affects organizations using Veeam Backup for Microsoft 365 with cross-organization transfer configured.
Recommendation
Update Veeam Backup for Microsoft 365 to a patched version. Limit trust in organization-transfer peers and apply least privilege to service accounts.
Other vulnerabilities in Veeam Backup for Microsoft 365
See all- CVE-2026-106078Medium
An unauthenticated attacker can bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
- CVE-2026-106077High
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- CVE-2025-64394Medium
A low-privileged local user can write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
Original NVD description (English source)
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS