CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and...
CriticalCVSS 9.0
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Veeam Backup for Microsoft 365 | >= 8.0, <= 8.5.0.1014 | No fix listed |