CVE-2026-106076: SQL Injection
Published Oct 27, 2026
·Updated
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Affected Software
1 affected component
Veeam Backup for Microsoft 365
Event History
Oct 27, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be an authenticated organization-transfer peer. The issue affects the source Veeam Backup for Microsoft 365 server involved in the organization transfer.
2
What is the potential impact if exploitation succeeds?
An attacker can inject SQL into the source server's configuration database, enabling cross-tenant reads and writes of configuration data. The issue can also lead to remote code execution as the PostgreSQL service account.