Live › vulnerability › CVE-2026-106078
Go to dashboardA flaw in Veeam Backup for Microsoft 365 lets an unauthenticated attacker forge a federation token to get past REST API authentication. The attacker receives responses from REST API endpoints that do not call the backup service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Teams running Veeam Backup for Microsoft 365 with its REST API reachable from the network are the ones to look at. The sources do not say which versions are affected or whether federation must be enabled, so unknown.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
This page as .md · .json · in your agent: get_signal("CVE-2026-106078")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.