SQL Injection in Veeam Backup for Microsoft 365 Configuration Database
CVE-2026-106076

9CRITICAL

Key Information:

Vendor

Veeam
Status
Backup For Microsoft 365
Vendor
CVE Published:
27 October 2026

What is CVE-2026-106076?

This vulnerability permits an authenticated organization-transfer peer to execute SQL injection attacks against the configuration database of the Veeam Backup for Microsoft 365 server. This can result in unauthorized cross-tenant access, allowing attackers to read and modify configuration data and potentially leading to remote code execution as the PostgreSQL service account.

Affected Version(s)

Backup for Microsoft 365 8.0 <= 8.5.0.1014

References

https://www.veeam.com/kb4957

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.