CVE-2026-106076EUVD-2026-111123
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backu
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Veeam Backup for Microsoft 365 is affected by a flaw that lets an authenticated organization-transfer peer inject SQL into the source server's configuration database. An attacker could use this to read and modify configuration data across tenants and execute code as the PostgreSQL service account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Affected versions
- Veeam Backup for Microsoft 365
From 8.0 · through 8.5.0.1014