{"id":"CVE-2026-107238","kind":"vulnerability","aliases":["CVE-2026-107238"],"related":[],"title":"Veeam Management Pack Collector: domain user can run code as SYSTEM","description":"A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.","summary":"The Veeam Management Pack for Microsoft System Center Collector service lets any authenticated domain user run code as LocalSystem over the network (CVSS v4 8.7). Veeam fixed it in 13.1.0.334 and will not patch 9.x.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Management Pack for Microsoft System Center","fixed":["13.1.0.334"],"affected":"<= 9.1 (all version 9 builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["active-directory","runtime","scom","system-center","veeam","veeam-management-pack","windows"],"not_affected_if":["collector-not-installed","component-not-installed","version-13.1.0.334-or-later"],"how_to_check":"In the Operations Manager console, Administration > Management Packs, check the Veeam Management Pack version. Any 9.x build (9.1.0.3107 or earlier) with the Collector service is affected; 13.1.0.334 is fixed.","fix":"Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). No patch for 9.x; upgrade to 13.1 is supported only from 9a (build 9.1.0.3107).","status":"open","published_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","triaged_at":"2026-10-29T23:29:03+00:00","updated_at":"2026-10-29T23:30:30+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-29T23:29:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Veeam Management Pack Collector: domain user can run code as SYSTEM","impact":"high","summary":"The Veeam Management Pack for Microsoft System Center Collector service has a flaw that lets an authenticated domain user run remote code. The code runs as the LocalSystem account, the highest local privilege on a Windows server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["veeam","windows","system-center","active-directory"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as SYSTEM on the server.","analyst_note":"Find the Veeam advisory and the affected and fixed version ranges; the NVD entry gives no versions or fix.","how_to_check":"- Check whether the Veeam Management Pack for Microsoft System Center Collector service is installed on Windows servers.\n- Confirm the installed version against the product ranges in the vendor advisory; the sources do not list them.","plain_action":"","needs_analyst":true,"not_affected_if":["component-not-installed"],"who_is_affected":"Servers running the Veeam Management Pack for Microsoft System Center Collector service are exposed. An attacker needs a valid domain user account first, so the risk is highest where many staff or service accounts have domain logons. Teams that do not run this Veeam component can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4093,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Veeam advisory and the affected and fixed version ranges; the NVD entry gives no versions or fix.","search":"'-107238':14A,17A '-2026':13A,16A '13.1.0.334':68B '8.7':63B '9':73B 'account':91C 'activ':26B 'active-directori':25B 'allow':77C 'authent':51B,79C 'center':24A,32B,46B,102C 'code':9A,55B,85C 'collector':4A,47B,103C 'cve':12A,15A 'cvss':61B 'directori':27B 'domain':5A,52B,80C 'execut':86C 'fix':65B 'for':21A 'let':49B 'localsystem':57B,90C 'manag':2A,36B,41B,97C 'management':19A 'microsoft':22A,44B,100C 'network':60B 'pack':3A,20A,37B,42B,98C 'patch':72B 'perform':83C 'rce':87C 'remot':84C 'run':8A,54B,94C 'runtim':28B 'scom':29B 'server':93C 'servic':48B,104C 'system':11A,23A,31B,45B,101C 'system-cent':30B 'user':6A,53B,81C 'v4':62B 'veeam':1A,18A,33B,35B,40B,64B,96C 'veeam-management-pack':34B 'vulner':76C 'window':38B 'x':74B","nicknames":[],"mitigations":[],"who_affected":"Windows servers running the Veeam Management Pack for Microsoft System Center Collector service, version 9.x, typically in System Center Operations Manager environments. Any authenticated domain user can reach it over the network and get SYSTEM. Teams on 13.1.0.334 or without the Collector can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T23:30:30Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1117},"products":{"at":"2026-10-29T23:30:30Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1117},"how_to_check":{"at":"2026-10-29T23:30:30Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1117},"who_affected":{"at":"2026-10-29T23:30:30Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1117}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T23:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107238","severity":null,"published_at":"2026-10-29T23:16:54+00:00","modified_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","fetched_at":"2026-10-29T23:27:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107238:1117","url":null,"severity":null,"published_at":"2026-10-29T23:30:30+00:00","modified_at":"2026-10-29T23:30:30+00:00","first_seen_at":"2026-10-29T23:30:30+00:00","fetched_at":"2026-10-29T23:30:30+00:00","note":"Read Veeam KB4961 (and KB4949): affects Management Pack 9.1 and all earlier v9 builds incl. VBR13 compat patch; fixed in 13.1.0.334; no fix for 9.x. No exploitation reported in sources."}],"documents":[{"id":20025,"url":"https://www.veeam.com/kb4961","title":"KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":20026,"url":"https://www.veeam.com/kb4949","title":"KB4949: Release Information for Veeam Management Pack 13.1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}