Veeam Backup for Microsoft 365 SQL Injection (CVE-2026-106076)

Veeam describes CVE-2026-106076 as a flaw "allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server." Veeam says this leads to "cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account."

Veeam rates the flaw Critical, with a CVSS v4.0 score of 9.0. The vector is AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. HackerOne issued the CVE record and lists CWE-89, SQL injection. Veeam says the flaw was reported through HackerOne.

What Does the Attacker Need?

The attacker is not anonymous. Veeam names an authenticated organization-transfer peer, and the vector marks low privileges. The attack requirements are marked as present, so some condition must hold. KB4957 does not say what that condition is or how a server gets such a peer.

This is our reading of the vector, not a statement from Veeam. The attack runs over the network, with low complexity and no user action. The impact is high on the vulnerable system and on connected systems, for all three of secrecy, integrity and availability.

Why the Database Host Matters

Veeam's version 8 system requirements say the configuration and cache database runs on PostgreSQL 15 or 16. It can be a local or a remote install, or Azure Database for PostgreSQL.

This is our reading, not Veeam's. When the database is remote, the PostgreSQL service account may live on another host than the backup server. KB4957 does not say on which host the code runs. "Cross-tenant" is Veeam's word, so configuration data of more than one organization on the same server is in scope.

Same Update, Three More Flaws

KB4957 lists three more CVEs for the same product. We cover them on this page rather than on pages of their own.

• CVE-2026-106077 (High, 8.3): a user with the Veeam Backup for Microsoft 365 Administrator role can read any file on the backup server with LocalSystem rights. Build 8.6.0.1102 fixes it.
• CVE-2026-106078 (Medium, 6.9): an attacker with no login can bypass REST API authentication with a forged federation token. Veeam says the attacker then gets answers from REST API endpoints that do not call the backup service. 8.6 Patch 1, build 8.6.0.5011, is the first build that fixes it.
• CVE-2025-64394 (Medium, 4.3): a local user with low rights can write files with SYSTEM rights during installation. Build 8.6.0.5011 fixes it as well.

What Our Checks Showed

These are the public signals we checked on 30 October 2026.

We are not saying this flaw is exploited. Veeam does warn that after a patch is out, "attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments." Our news post on the October Veeam fixes covers the Backup & Replication and Veeam ONE flaws fixed the same day.

The critical Backup & Replication flaw has its own page, CVE-2026-108142. Our Veeam Management Pack post covers a separate advisory for another product.

Veeam lists Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds as affected. The fix starts with Veeam Backup for Microsoft 365 8.6, build 8.6.0.1102. The CVE record lists version 8.0 up to and including 8.5.0.1014.

Veeam adds that unsupported versions "were not tested, but are likely affected and should be considered vulnerable." Treat older major versions as exposed until they are upgraded.

Build 8.6.0.1102 closes CVE-2026-106076 but not CVE-2026-106078 or CVE-2025-64394. Patch 1, build 8.6.0.5011, is the first build in KB4957 that covers all four. KB4957 names no workaround.

Our patch management entry covers how to plan and check a rollout.