CVE-2026-107238
HighCVSS 8.7Summary
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Risk Assessment
A domain user could gain the highest privileges on the server, risking domain-wide escalation and infrastructure takeover.
Recommendation
Immediately install the patch for Veeam Management Pack for Microsoft System Center and restrict domain account privileges on Collector servers.
Other vulnerabilities in Veeam Management Pack for Microsoft System Center
See all- CVE-2026-107239High
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- CVE-2023-22793Critical
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
Original NVD description (English source)
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS