Veeam patches seven flaws, including critical remote code execution

Veeam has released patches for seven vulnerabilities across two products—Veeam Management Pack and Veeam Backup for Microsoft 365—with two rated as Critical. The most severe, CVE-2023-22793, scores 9.3 on CVSS v4 and allows an unauthenticated attacker to perform remote code execution on the Virtualization Extensions service in the Management Pack.

Two additional high-severity flaws, CVE-2026-107239 (8.8) and CVE-2026-107238 (8.7), enable RCE on the Collector service and can run code as the LocalSystem account for any authenticated domain user.

The Backup for Microsoft 365 product includes CVE-2026-106076 (9.0), a SQL injection flaw that can enable cross-tenant read and write of configuration data, alongside other issues that permit admin-level file reads as LocalSystem, REST API authentication bypass with forged tokens, and local privilege escalation during installation. In total, the advisory references 7 CVEs, with the highest severity being 9.3 for CVE-2023-22793.

Affected versions are Management Pack 9.1 and all earlier 9 builds, and Veeam Backup for Microsoft 365 8.6.0.1102 and earlier version 8 builds. Veeam directs users to update to Management Pack 13.1 (build 13.1.0.334) and Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011); it notes that Patch 9.x for Management Pack will not be issued. At the time of reporting, no attacks had been publicly confirmed.

The firm emphasises applying the latest security updates promptly to reduce patch-evasion risk, particularly given that backups hold sensitive data and an attackers’ interest in patch reversals post-disclosure. The disclosures reference KB4961 for Management Pack and KB4957 for Backup for Microsoft 365.