CVE-2026-106077: Veeam Veeam Backup for Microsoft 365 vulnerability
Published Oct 27, 2026
·Updated
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
Affected Software
1 affected component
Veeam Veeam Backup for Microsoft 365
Event History
Oct 27, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs the Veeam Backup for Microsoft 365 Administrator role.
2
What systems and accounts are at risk?
The backup server is affected, because the issue allows the specified administrator-role user to read arbitrary files from it with LocalSystem privileges.