{"id":"CVE-2026-107239","kind":"vulnerability","aliases":["CVE-2026-107239"],"related":[],"title":"Veeam Management Pack: group member can run code remotely on collector servers","description":"A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.","summary":"A member of the Veeam Virtualization Extensions Users group can run arbitrary code on servers running the Veeam Management Pack for Microsoft System Center Collector service. The sources give a CVSS score of 8.8 and do not say whether a fix is available.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Management Pack for Microsoft System Center","fixed":["13.1.0.334"],"affected":"<= 9.1 (all 9.x builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","microsoft-system-center","scom","veeam","veeam-management-pack","windows"],"not_affected_if":["group-not-used","no-collector-service","version-13.1.0.334-or-later"],"how_to_check":"In the Operations Manager console, Administration > Management Packs: check the Veeam MP build. Any 9.x build (9.1.0.3107 or earlier) is affected; 13.1.0.334 is fixed. Check remote Collector servers too, and review membership of the Veeam Virtualization Extensions Users group.","fix":"Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). No fix for 9.x; upgrade to 13.1 is supported only from 9a (build 9.1.0.3107).","status":"open","published_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","triaged_at":"2026-10-29T23:29:03+00:00","updated_at":"2026-10-29T23:30:22+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T23:29:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Veeam Management Pack: group member can run code remotely on collector servers","impact":"high","summary":"A member of the Veeam Virtualization Extensions Users group can run arbitrary code on servers running the Veeam Management Pack for Microsoft System Center Collector service. The sources give a CVSS score of 8.8 and do not say whether a fix is available.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["veeam","microsoft-system-center","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the collector server","analyst_note":"Find the vendor advisory and the fixed Veeam Management Pack version; the NVD entry alone gives no affected range or fix.","how_to_check":"- Check whether the Veeam Management Pack for Microsoft System Center Collector service is installed on the server\n- Review membership of the Veeam Virtualization Extensions Users group\n- Confirm the installed version against the vendor advisory: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-collector-service","group-not-used"],"who_is_affected":"Teams running the Veeam Management Pack for Microsoft System Center Collector service are exposed, and only accounts in the Veeam Virtualization Extensions Users group can use this path. Teams without that service or without that group can skip it. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4093,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed Veeam Management Pack version; the NVD entry alone gives no affected range or fix.","search":"'-107239':15A,18A '-2026':14A,17A '8.8':71B 'allow':83C 'arbitrari':49B 'avail':80B 'center':25A,30B,61B,109C 'code':8A,50B,96C 'collector':11A,62B,110C 'cve':13A,16A 'cvss':68B 'execut':97C 'extens':44B,90C 'fix':78B 'for':22A 'give':66B 'group':4A,46B,92C 'infrastructur':26B 'manag':2A,35B,56B,104C 'management':20A 'member':5A,39B,85C 'microsoft':23A,28B,59B,107C 'microsoft-system-cent':27B 'pack':3A,21A,36B,57B,105C 'perform':94C 'rce':98C 'remot':9A,95C 'run':7A,48B,53B,101C 'say':75B 'scom':31B 'score':69B 'server':12A,52B,100C 'servic':63B,111C 'sourc':65B 'system':24A,29B,60B,108C 'user':45B,91C 'veeam':1A,19A,32B,34B,42B,55B,88C,103C 'veeam-management-pack':33B 'virtual':43B,89C 'vulner':82C 'whether':76B 'window':37B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Veeam Management Pack for Microsoft System Center 9.x with the Collector service in System Center Operations Manager. A member of the Veeam Virtualization Extensions Users group can run code remotely on the Collector servers (CVSS v4 8.8). Teams without this product, or already on 13.1.0.334, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T23:30:22Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1116},"products":{"at":"2026-10-29T23:30:22Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1116},"how_to_check":{"at":"2026-10-29T23:30:22Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1116},"who_affected":{"at":"2026-10-29T23:30:22Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1116}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T23:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107239","severity":null,"published_at":"2026-10-29T23:16:54+00:00","modified_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","fetched_at":"2026-10-29T23:27:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107239:1116","url":null,"severity":null,"published_at":"2026-10-29T23:30:22+00:00","modified_at":"2026-10-29T23:30:22+00:00","first_seen_at":"2026-10-29T23:30:22+00:00","fetched_at":"2026-10-29T23:30:22+00:00","note":"Read Veeam KB4961 (advisory) and KB4949: affected MP 9.1 and all 9.x builds; fixed in 13.1.0.334; no 9.x fix. No exploitation or PoC seen; did not search social."}],"documents":[{"id":20025,"url":"https://www.veeam.com/kb4961","title":"KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":20026,"url":"https://www.veeam.com/kb4949","title":"KB4949: Release Information for Veeam Management Pack 13.1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}