Multiple security vulnerabilities have been identified in Veeam Backup for Microsoft 365 and Management Pack for Microsoft System Center, affecting backup data protection and management functionality. The issues include critical and high-severity flaws that can allow remote code execution, SQL injection, authentication bypass, or privilege escalation. Veeam Backup for Microsoft 365 version 8.6.0.1102 is stated as affected, and no active exploitation has been reported.
CVE-2023-22793 (CVSS 9.3 — Critical): This flaw allows an unauthenticated attacker to perform remote code execution on the Virtualization Extensions service in Management Pack for Microsoft System Center. The vulnerability is rated critical and no exploitation has been reported.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Veeam Backup for Microsoft 365 and Management Pack for Microsoft System Center, affecting backup data protection and management functionality. The issues include critical and high-severity flaws that can allow remote code execution, SQL injection, authentication bypass, or privilege escalation. Veeam Backup for Microsoft 365 version 8.6.0.1102 is stated as affected, and no active exploitation has been reported.
CVE-2023-22793 (CVSS 9.3 — Critical): This flaw allows an unauthenticated attacker to perform remote code execution on the Virtualization Extensions service in Management Pack for Microsoft System Center. The vulnerability is rated critical and no exploitation has been reported.[emaillocker id="1283"]
CVE-2026-106076 (CVSS 9.0 — Critical): This flaw allows an organization-transfer peer in Veeam Backup for Microsoft 365 to inject SQL, leading to cross-tenant read and write of configuration data. The vulnerability is rated critical and no exploitation has been reported.
CVE-2026-107239 (CVSS 8.8 — High): This flaw enables remote code execution on the Collector service in Management Pack for Microsoft System Center. The vulnerability is rated high and no exploitation has been reported.
CVE-2026-107238 (CVSS 8.7 — High): This flaw enables remote code execution on the Collector service in Management Pack for Microsoft System Center, running code as the LocalSystem account for any authenticated domain user. The vulnerability is rated high and no exploitation has been reported.
CVE-2026-106077 (CVSS 8.3 — High): This high-severity vulnerability affects Veeam Backup for Microsoft 365, but the disclosed details do not identify the specific flaw, exploitation path, or attacker capability. No exploitation has been reported.
CVE-2026-106078 (CVSS 6.9 — Medium): This medium-severity vulnerability affects Veeam Backup for Microsoft 365, but the disclosed details do not identify the specific flaw, exploitation path, or attacker capability. No exploitation has been reported.
CVE-2025-64394 (CVSS 4.3 — Medium): This medium-severity vulnerability affects Veeam Backup for Microsoft 365, but the disclosed details do not identify the specific flaw, exploitation path, or attacker capability. No exploitation has been reported.
These vulnerabilities collectively present a serious risk to environments that rely on the affected backup and management components, especially where services are reachable by unauthenticated or low-privileged users. Organizations with exposed backup infrastructure, broad administrative trust, or cross-tenant configuration access are most at risk. The general action is to prioritize these as urgent security issues.
The following reports contain further technical details:
[/emaillocker]