9.0
CriticalCVSS 4.0 · from hackerone
CVE-2026-106076
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read…
Backup for Microsoft 365 · SQL injection · CWE-89AffectedBackup for Microsoft 365
FixNo fix listed yet.
PublishedOct 27, 16:16 · hackerone
ScoredOct 27 · 9.0 · hackerone
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
From hackerone
Affected and fixed versions
ProductAffectedFixed inBackup for Microsoft 3658.0 – 8.5.0.1014–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known