8.8
HighCVSS 4.0 · from hackerone
CVE-2026-107239
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center…
Management Pack for Microsoft System Center · CWE-23 · CWE-23AffectedManagement Pack for Microsoft System Center
FixUpdate to 13.1.0.334 or newer
PublishedOct 29, 22:55 · hackerone
ScoredOct 29 · 8.8 · hackerone
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
From hackerone
Affected and fixed versions
ProductAffectedFixed inManagement Pack for Microsoft System Center9.0 – before 13.1.0.33413.1.0.334
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known