{"id":"CVE-2026-106076","kind":"vulnerability","aliases":["CVE-2026-106076"],"related":[],"title":"Veeam Backup for Microsoft 365: SQL injection leads to remote code execution","description":"A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.","summary":"An authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. An attacker can read and write configuration data across tenants and run code as the PostgreSQL service account.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Backup for Microsoft 365","fixed":["8.6.0.1102"],"affected":"<= 8.5.0.1014 (all v8 builds before 8.6)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft-365","rce","self-hosted","sql-injection","veeam","veeam-backup-for-microsoft-365","vendor"],"not_affected_if":["no-organization-transfer"],"how_to_check":"Check the build number in the VB365 console (Help > About). Builds 8.5.0.1014 and earlier v8 builds are vulnerable; 8.6.0.1102 or later is fixed. Unsupported older versions are likely affected too. See KB4106 for build numbers.","fix":"Upgrade Veeam Backup for Microsoft 365 to 8.6 build 8.6.0.1102 or later; 8.6 Patch 1 (8.6.0.5011, KB4913) is the current build and also fixes other CVEs (CVE-2026-106078, CVE-2025-64394).","status":"open","published_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:21+00:00","updated_at":"2026-10-27T17:35:18+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-27T17:34:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Veeam Backup for Microsoft 365: SQL injection leads to remote code execution","impact":"high","summary":"An authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. An attacker can read and write configuration data across tenants and run code as the PostgreSQL service account.","category":"vendor","nicknames":[],"who_cares":["veeam-backup-for-microsoft-365","microsoft-365","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs as the PostgreSQL service account; configuration data across tenants is readable and writable.","analyst_note":"Check Veeam's security advisory for affected and fixed build numbers and the exact organization-transfer configuration needed; the NVD entry alone gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-organization-transfer"],"who_is_affected":"Organizations running Veeam Backup for Microsoft 365 that use the organization-transfer feature between servers. Installations without organization transfer peers are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000559,"input_tokens":3305,"output_tokens":458,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Veeam's security advisory for affected and fixed build numbers and the exact organization-transfer configuration needed; the NVD entry alone gives no versions.","search":"'-106076':15A,18A '-2026':14A,17A '-365':25B '365':5A,23A,39B,61B,104C 'account':80B,125C 'across':71B 'allow':83C 'attack':64B 'authent':42B,85C 'backup':2A,20A,36B,58B,101C 'code':11A,75B,119C 'configur':52B,69B,95C,115C 'cross':109C 'cross-ten':108C 'cve':13A,16A 'data':70B,116C 'databas':53B,96C 'execut':12A,120C 'for':21A 'host':29B 'inject':7A,32B,48B,91C 'lead':8A,106C 'microsoft':4A,22A,24B,38B,60B,103C 'organ':44B,87C 'organization-transf':43B,86C 'peer':46B,89C 'postgresql':78B,123C 'rce':26B 'read':66B,111C 'remot':10A,118C 'run':74B 'self':28B 'self-host':27B 'server':62B,105C 'servic':79B,124C 'sourc':56B,99C 'sql':6A,31B,49B,92C 'sql-inject':30B 'tenant':72B,110C 'transfer':45B,88C 'veeam':1A,19A,33B,35B,57B,100C 'veeam-backup-for-microsoft':34B 'vendor':40B 'vulner':82C 'write':68B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Veeam Backup for Microsoft 365 v8 at build 8.5.0.1014 or earlier. An attacker needs authenticated access as an organization-transfer peer, which can inject SQL into the source server's configuration database. That allows cross-tenant config read/write and code execution as the PostgreSQL service account. Servers already on 8.6.0.1102 or later can skip it. Veeam does not say which transfer setup is required, so treat any v8 server that takes part in organization transfer as exposed.","tier":"B","verified":{"fix":{"at":"2026-10-27T17:35:18Z","by":"analyst","run_id":893},"how_to_check":{"at":"2026-10-27T17:35:18Z","by":"analyst","run_id":893},"who_affected":{"at":"2026-10-27T17:35:18Z","by":"analyst","run_id":893}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106076","severity":null,"published_at":"2026-10-27T17:16:56+00:00","modified_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106076:893","url":null,"severity":null,"published_at":"2026-10-27T17:35:18+00:00","modified_at":"2026-10-27T17:35:18+00:00","first_seen_at":"2026-10-27T17:35:18+00:00","fetched_at":"2026-10-27T17:35:18+00:00","note":"Veeam KB4957/KB4913 read: affected 8.5.0.1014 and all earlier v8 builds; fixed in 8.6 (8.6.0.1102). Advisory does not describe the org-transfer configuration needed; no exploitation/PoC seen (social not searched)."}],"documents":[{"id":7174,"url":"https://www.veeam.com/kb4957","title":"KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7175,"url":"https://www.veeam.com/kb4913","title":"KB4913: Release Information for Veeam Backup for Microsoft 365 8.6 and Cumulative Patches","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}