{"id":"CVE-2026-106078","kind":"vulnerability","aliases":["CVE-2026-106078"],"related":[],"title":"Veeam Backup for Microsoft 365: forged federation token bypasses REST API authentication","description":"A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.","summary":"A flaw in Veeam Backup for Microsoft 365 lets an unauthenticated attacker forge a federation token to get past REST API authentication. The attacker receives responses from REST API endpoints that do not call the backup service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","microsoft-365","other","self-hosted","veeam"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:44+00:00","updated_at":"2026-10-27T17:34:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T17:34:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Veeam Backup for Microsoft 365: forged federation token bypasses REST API authentication","impact":"low","summary":"A flaw in Veeam Backup for Microsoft 365 lets an unauthenticated attacker forge a federation token to get past REST API authentication. The attacker receives responses from REST API endpoints that do not call the backup service.","category":"other","nicknames":[],"who_cares":["veeam","backup","microsoft-365","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker reads some REST API responses without credentials","analyst_note":"Find the affected and fixed Veeam Backup for Microsoft 365 versions and whether federation is required, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106078 or the Veeam advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Veeam Backup for Microsoft 365 with its REST API reachable from the network are the ones to look at. The sources do not say which versions are affected or whether federation must be enabled, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000558,"input_tokens":3290,"output_tokens":458,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106078':15A,18A '-2026':14A,17A '-365':21B '365':5A,34B,96C 'allow':66C 'api':11A,47B,55B,73C,85C 'attack':38B,50B,69C 'authent':12A,48B,74C 'backup':2A,19B,31B,62B,93C,97C 'bypass':9A,71C 'call':60B,90C 'cve':13A,16A 'endpoint':56B,86C 'feder':7A,41B,78C 'flaw':28B 'forg':6A,39B,77C 'get':44B 'host':25B 'let':35B 'microsoft':4A,20B,33B,95C 'past':45B 'receiv':51B,81C 'respons':52B,82C 'rest':10A,46B,54B,72C,84C 'self':24B 'self-host':23B 'servic':63B,98C 'token':8A,42B,79C 'unauthent':37B,68C 'veeam':1A,26B,30B,92C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running Veeam Backup for Microsoft 365 with its REST API reachable from the network are the ones to look at. The sources do not say which versions are affected or whether federation must be enabled, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106078","severity":null,"published_at":"2026-10-27T17:16:56+00:00","modified_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}