Authentication Bypass Vulnerability in Veeam Backup for Microsoft 365
CVE-2026-106078

6.9MEDIUM

Key Information:

Vendor

Veeam
Status
Backup For Microsoft 365
Vendor
CVE Published:
27 October 2026

What is CVE-2026-106078?

This vulnerability allows an unauthenticated attacker to bypass the REST API authentication mechanism using a forged federation token. This exploit enables unauthorized users to access responses from REST API endpoints that should be restricted from public access, potentially exposing sensitive data and compromising the security of Veeam Backup for Microsoft 365.

Affected Version(s)

Backup for Microsoft 365 8.0 <= 8.6.0.1102

References

https://www.veeam.com/kb4957

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.