Veeam Patches Seven Vulnerabilities in Backup for Microsoft 365 and Management Pack
Do Son 
TL;DR
Veeam has fixed seven Veeam vulnerabilities across two products this week, including two rated Critical. The worst, CVE-2023-22793, scores 9.3 on CVSS v4. It allows unauthenticated remote code execution in Veeam Management Pack for Microsoft System Center. Meanwhile, Veeam Backup for Microsoft 365 receives four fixes, led by a 9.0 SQL injection bug.
Upgrade Veeam Backup for Microsoft 365 to 8.6 Patch 1 and Management Pack to 13.1. Veeam will not patch Management Pack 9.x. No attacks have been reported.
- Total: 7 CVEs
- Severity: 2 Critical · 3 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.3 (Critical · CVSSv4) — CVE-2023-22793
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Fixed in | Status |
|---|---|---|---|
| CVE-2023-22793 | 9.3 | 13.1.0.334 | Not exploited |
| CVE-2026-106076 | 9 | — | Not exploited |
| CVE-2026-107239 | 8.8 | 13.1.0.334 | Not exploited |
| CVE-2026-107238 | 8.7 | 13.1.0.334 | Not exploited |
| CVE-2026-106077 | 8.3 | — | Not exploited |
| CVE-2026-106078 | 6.9 | — | Not exploited |
| CVE-2025-64394 | 4.3 | — | Not exploited |
Why It Matters
Backup servers hold copies of an organization’s most sensitive data. Veeam itself warns that after a disclosure, “attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments.”
How the Attack Works
Veeam Management Pack (KB4961)
CVE-2023-22793 allows “an unauthenticated attacker to perform remote code execution (RCE)” on the Virtualization Extensions service. Two High flaws, CVE-2026-107239 (8.8) and CVE-2026-107238 (8.7), also enable RCE on the Collector service. The second runs code “as the LocalSystem account” for any authenticated domain user.
Veeam Backup for Microsoft 365 (KB4957)
CVE-2026-106076 lets an organization-transfer peer inject SQL, “leading to cross-tenant read and write of configuration data.” Other Veeam vulnerabilities in this product allow admin-level file reads as LocalSystem, a REST API authentication bypass with forged tokens, and a local privilege escalation during installation.
Affected Versions
- Management Pack 9.1 and all earlier version 9 builds
- Veeam Backup for Microsoft 365 8.6.0.1102 and earlier version 8 builds
Patch and Mitigation
Install Management Pack 13.1 (build 13.1.0.334) and Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011). Full details on these Veeam vulnerabilities are in KB4961 for Management Pack and KB4957 for Backup for Microsoft 365.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
