---
id: "CVE-2026-107238"
kind: "vulnerability"
aliases: ["CVE-2026-107238"]
title: "Veeam Management Pack Collector: domain user can run code as SYSTEM"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Veeam Management Pack for Microsoft System Center", "fixed": ["13.1.0.334"], "affected": "<= 9.1 (all version 9 builds)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["active-directory", "runtime", "scom", "system-center", "veeam", "veeam-management-pack", "windows"]
not_affected_if: ["collector-not-installed", "component-not-installed", "version-13.1.0.334-or-later"]
published_at: "2026-10-29T23:16:54+00:00"
first_seen_at: "2026-10-29T23:27:17+00:00"
updated_at: "2026-10-29T23:30:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107238", "first_seen_at": "2026-10-29T23:27:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T23:30:30+00:00"}]
---

# Veeam Management Pack Collector: domain user can run code as SYSTEM

The Veeam Management Pack for Microsoft System Center Collector service lets any authenticated domain user run code as LocalSystem over the network (CVSS v4 8.7). Veeam fixed it in 13.1.0.334 and will not patch 9.x.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Management Pack for Microsoft System Center affected <= 9.1 (all version 9 builds) fixed 13.1.0.334

## How to check

In the Operations Manager console, Administration > Management Packs, check the Veeam Management Pack version. Any 9.x build (9.1.0.3107 or earlier) with the Collector service is affected; 13.1.0.334 is fixed.

## Fix

Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). No patch for 9.x; upgrade to 13.1 is supported only from 9a (build 9.1.0.3107).

## Timeline

- 2026-10-29T23:27:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107238
- 2026-10-29T23:30:30+00:00 analyst — Read Veeam KB4961 (and KB4949): affects Management Pack 9.1 and all earlier v9 builds incl. VBR13 compat patch; fixed in 13.1.0.334; no fix for 9.x. No exploitation reported in sources.

## Documents

- [advisory] KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1 https://www.veeam.com/kb4961
- [fix] KB4949: Release Information for Veeam Management Pack 13.1 https://www.veeam.com/kb4949

## From the sources

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_