Live › vulnerability › CVE-2026-106077
Go to dashboardA user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server. The file reads run with LocalSystem privileges, so the attacker can reach files the product account should never see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Any Veeam Backup for Microsoft 365 v8 server on build 8.5.0.1014 or earlier. Exploitation needs a user with the VB365 Administrator role, who can then read any file on the backup server as LocalSystem. Teams where only trusted people hold that role carry less risk, but should still patch. Unsupported older versions are likely affected too.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup for Microsoft 365 | vendor | <= 8.5.0.1014 (all v8 builds) | 8.6.0.1102 |
8.5.0.1014 or older (any v8) are vulnerable, 8.6.0.1102 or newer is fixedUpgrade Veeam Backup for Microsoft 365 to 8.6 (build 8.6.0.1102) or later; 8.6 Patch 1 (8.6.0.5011) is the current build and also fixes the sibling CVE-2026-106078 and CVE-2025-64394.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-106077")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.