Live › vulnerability › CVE-2026-106076
Go to dashboardAn authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. An attacker can read and write configuration data across tenants and run code as the PostgreSQL service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Teams running self-hosted Veeam Backup for Microsoft 365 v8 at build 8.5.0.1014 or earlier. An attacker needs authenticated access as an organization-transfer peer, which can inject SQL into the source server's configuration database. That allows cross-tenant config read/write and code execution as the PostgreSQL service account. Servers already on 8.6.0.1102 or later can skip it. Veeam does not say which transfer setup is required, so treat any v8 server that takes part in organization transfer as exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup for Microsoft 365 | vendor | <= 8.5.0.1014 (all v8 builds before 8.6) | 8.6.0.1102 |
8.5.0.1014 and earlier v8 builds are vulnerable; 8.6.0.1102 or later is fixedUpgrade Veeam Backup for Microsoft 365 to 8.6 build 8.6.0.1102 or later; 8.6 Patch 1 (8.6.0.5011, KB4913) is the current build and also fixes other CVEs (CVE-2026-106078, CVE-2025-64394).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
This page as .md · .json · in your agent: get_signal("CVE-2026-106076")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.