---
id: "CVE-2026-106076"
kind: "vulnerability"
aliases: ["CVE-2026-106076"]
title: "Veeam Backup for Microsoft 365: SQL injection leads to remote code execution"
severity: "critical"
cvss: 9.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Veeam Backup for Microsoft 365", "fixed": ["8.6.0.1102"], "affected": "<= 8.5.0.1014 (all v8 builds before 8.6)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["microsoft-365", "rce", "self-hosted", "sql-injection", "veeam", "veeam-backup-for-microsoft-365", "vendor"]
not_affected_if: ["no-organization-transfer"]
published_at: "2026-10-27T17:16:56+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:35:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106076", "first_seen_at": "2026-10-27T17:32:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:35:18+00:00"}]
---

# Veeam Backup for Microsoft 365: SQL injection leads to remote code execution

An authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. An attacker can read and write configuration data across tenants and run code as the PostgreSQL service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup for Microsoft 365 affected <= 8.5.0.1014 (all v8 builds before 8.6) fixed 8.6.0.1102

## How to check

Check the build number in the VB365 console (Help > About). Builds 8.5.0.1014 and earlier v8 builds are vulnerable; 8.6.0.1102 or later is fixed. Unsupported older versions are likely affected too. See KB4106 for build numbers.

## Fix

Upgrade Veeam Backup for Microsoft 365 to 8.6 build 8.6.0.1102 or later; 8.6 Patch 1 (8.6.0.5011, KB4913) is the current build and also fixes other CVEs (CVE-2026-106078, CVE-2025-64394).

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106076
- 2026-10-27T17:35:18+00:00 analyst — Veeam KB4957/KB4913 read: affected 8.5.0.1014 and all earlier v8 builds; fixed in 8.6 (8.6.0.1102). Advisory does not describe the org-transfer configuration needed; no exploitation/PoC seen (social not searched).

## Documents

- [advisory] KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 https://www.veeam.com/kb4957
- [fix] KB4913: Release Information for Veeam Backup for Microsoft 365 8.6 and Cumulative Patches https://www.veeam.com/kb4913

## From the sources

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_