Live › vulnerability › CVE-2026-107238
The Veeam Management Pack for Microsoft System Center Collector service lets any authenticated domain user run code as LocalSystem over the network (CVSS v4 8.7). Veeam fixed it in 13.1.0.334 and will not patch 9.x.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 23:27 UTC. All times on this page are UTC.
Windows servers running the Veeam Management Pack for Microsoft System Center Collector service, version 9.x, typically in System Center Operations Manager environments. Any authenticated domain user can reach it over the network and get SYSTEM. Teams on 13.1.0.334 or without the Collector can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Management Pack for Microsoft System Center | vendor | <= 9.1 (all version 9 builds) | 13.1.0.334 |
9.1.0.310713.1.0.33413.1.0.334)9.1.0.3107)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
This page as .md · .json · in your agent: get_signal("CVE-2026-107238")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.