{"id":"CVE-2026-106077","kind":"vulnerability","aliases":["CVE-2026-106077"],"related":[],"title":"Veeam Backup for Microsoft 365: admin role reads arbitrary files as LocalSystem","description":"A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.","summary":"A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server. The file reads run with LocalSystem privileges, so the attacker can reach files the product account should never see.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Backup for Microsoft 365","fixed":["8.6.0.1102"],"affected":"<= 8.5.0.1014 (all v8 builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["self-hosted","veeam-backup-for-microsoft-365","vendor","windows"],"not_affected_if":[],"how_to_check":"In the VB365 console check Help > About for the build number; builds 8.5.0.1014 or older (any v8) are vulnerable, 8.6.0.1102 or newer is fixed. Also review who holds the Backup for Microsoft 365 Administrator role.","fix":"Upgrade Veeam Backup for Microsoft 365 to 8.6 (build 8.6.0.1102) or later; 8.6 Patch 1 (8.6.0.5011) is the current build and also fixes the sibling CVE-2026-106078 and CVE-2025-64394.","status":"open","published_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:27+00:00","updated_at":"2026-10-27T17:39:16+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-27T17:34:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Veeam Backup for Microsoft 365: admin role reads arbitrary files as LocalSystem","impact":"high","summary":"A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server. The file reads run with LocalSystem privileges, so the attacker can reach files the product account should never see.","category":"vendor","nicknames":[],"who_cares":["veeam-backup-for-microsoft-365","windows"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker reads any file on the backup server as LocalSystem","analyst_note":"Sources give only the NVD description; check the Veeam security bulletin for the fixed build and the affected version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":3280,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; check the Veeam security bulletin for the fixed build and the affected version range.","search":"'-106077':15A,18A '-2026':14A,17A '365':5A,23A,32B,43B,84C 'account':69B 'admin':6A 'administr':44B,85C 'allow':75C 'arbitrari':9A,48B,89C 'attack':63B 'backup':2A,20A,29B,40B,52B,81C,93C 'cve':13A,16A 'file':10A,49B,55B,66B,90C 'for':21A 'host':26B 'localsystem':12A,59B,96C 'microsoft':4A,22A,31B,42B,83C 'never':71B 'privileg':60B,97C 'product':68B 'reach':65B 'read':8A,47B,56B,88C 'role':7A,45B,86C 'run':57B 'see':72B 'self':25B 'self-host':24B 'server':53B,94C 'user':36B,77C 'veeam':1A,19A,28B,39B,80C 'veeam-backup-for-microsoft':27B 'vendor':33B 'vulner':74C 'window':34B","nicknames":[],"mitigations":[],"who_affected":"Any Veeam Backup for Microsoft 365 v8 server on build 8.5.0.1014 or earlier. Exploitation needs a user with the VB365 Administrator role, who can then read any file on the backup server as LocalSystem. Teams where only trusted people hold that role carry less risk, but should still patch. Unsupported older versions are likely affected too.","tier":"B","verified":{"fix":{"at":"2026-10-27T17:39:16Z","by":"analyst","run_id":906},"products":{"at":"2026-10-27T17:39:16Z","by":"analyst","run_id":906},"how_to_check":{"at":"2026-10-27T17:39:16Z","by":"analyst","run_id":906},"who_affected":{"at":"2026-10-27T17:39:16Z","by":"analyst","run_id":906}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106077","severity":null,"published_at":"2026-10-27T17:16:56+00:00","modified_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106077:906","url":null,"severity":null,"published_at":"2026-10-27T17:39:16+00:00","modified_at":"2026-10-27T17:39:16+00:00","first_seen_at":"2026-10-27T17:39:16+00:00","fetched_at":"2026-10-27T17:39:16+00:00","note":"Read Veeam KB4957: affected 8.5.0.1014 and all earlier v8 builds, fixed in 8.6 (8.6.0.1102). No exploitation or PoC found; no vendor mitigations/workarounds listed. Not searched social."}],"documents":[{"id":7174,"url":"https://www.veeam.com/kb4957","title":"KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}