---
id: "CVE-2026-107239"
kind: "vulnerability"
aliases: ["CVE-2026-107239"]
title: "Veeam Management Pack: group member can run code remotely on collector servers"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Veeam Management Pack for Microsoft System Center", "fixed": ["13.1.0.334"], "affected": "<= 9.1 (all 9.x builds)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "microsoft-system-center", "scom", "veeam", "veeam-management-pack", "windows"]
not_affected_if: ["group-not-used", "no-collector-service", "version-13.1.0.334-or-later"]
published_at: "2026-10-29T23:16:54+00:00"
first_seen_at: "2026-10-29T23:27:17+00:00"
updated_at: "2026-10-29T23:30:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107239", "first_seen_at": "2026-10-29T23:27:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T23:30:22+00:00"}]
---

# Veeam Management Pack: group member can run code remotely on collector servers

A member of the Veeam Virtualization Extensions Users group can run arbitrary code on servers running the Veeam Management Pack for Microsoft System Center Collector service. The sources give a CVSS score of 8.8 and do not say whether a fix is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Management Pack for Microsoft System Center affected <= 9.1 (all 9.x builds) fixed 13.1.0.334

## How to check

In the Operations Manager console, Administration > Management Packs: check the Veeam MP build. Any 9.x build (9.1.0.3107 or earlier) is affected; 13.1.0.334 is fixed. Check remote Collector servers too, and review membership of the Veeam Virtualization Extensions Users group.

## Fix

Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). No fix for 9.x; upgrade to 13.1 is supported only from 9a (build 9.1.0.3107).

## Timeline

- 2026-10-29T23:27:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107239
- 2026-10-29T23:30:22+00:00 analyst — Read Veeam KB4961 (advisory) and KB4949: affected MP 9.1 and all 9.x builds; fixed in 13.1.0.334; no 9.x fix. No exploitation or PoC seen; did not search social.

## Documents

- [advisory] KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1 https://www.veeam.com/kb4961
- [fix] KB4949: Release Information for Veeam Management Pack 13.1 https://www.veeam.com/kb4949

## From the sources

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_