---
id: "CVE-2026-106077"
kind: "vulnerability"
aliases: ["CVE-2026-106077"]
title: "Veeam Backup for Microsoft 365: admin role reads arbitrary files as LocalSystem"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Veeam Backup for Microsoft 365", "fixed": ["8.6.0.1102"], "affected": "<= 8.5.0.1014 (all v8 builds)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["self-hosted", "veeam-backup-for-microsoft-365", "vendor", "windows"]
not_affected_if: []
published_at: "2026-10-27T17:16:56+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:39:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106077", "first_seen_at": "2026-10-27T17:32:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:39:16+00:00"}]
---

# Veeam Backup for Microsoft 365: admin role reads arbitrary files as LocalSystem

A user with the Veeam Backup for Microsoft 365 Administrator role can read arbitrary files on the backup server. The file reads run with LocalSystem privileges, so the attacker can reach files the product account should never see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup for Microsoft 365 affected <= 8.5.0.1014 (all v8 builds) fixed 8.6.0.1102

## How to check

In the VB365 console check Help > About for the build number; builds 8.5.0.1014 or older (any v8) are vulnerable, 8.6.0.1102 or newer is fixed. Also review who holds the Backup for Microsoft 365 Administrator role.

## Fix

Upgrade Veeam Backup for Microsoft 365 to 8.6 (build 8.6.0.1102) or later; 8.6 Patch 1 (8.6.0.5011) is the current build and also fixes the sibling CVE-2026-106078 and CVE-2025-64394.

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106077
- 2026-10-27T17:39:16+00:00 analyst — Read Veeam KB4957: affected 8.5.0.1014 and all earlier v8 builds, fixed in 8.6 (8.6.0.1102). No exploitation or PoC found; no vendor mitigations/workarounds listed. Not searched social.

## Documents

- [advisory] KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 https://www.veeam.com/kb4957

## From the sources

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_