EUVD lists unauthenticated RCE in Veeam System Center Management Pack
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Veeam
- Product
- Management Pack for Microsoft System Center
- First seen
Summary
The EU Vulnerability Database (EUVD) entry, as relayed in a Mastodon post, describes a flaw that lets an unauthenticated attacker execute code remotely on servers running the Veeam Virtualization Extensions service. The item gives a CVSS v3.1 score of 9.3/10.
If you use Veeam
Check the Veeam advisory for the affected versions and the fixed build
Apply the vendor patch to the Management Pack and its Virtualization Extensions service
Restrict network access to the affected service until patching is complete
Check the Veeam advisory for affected versions and the fixed build
Apply the vendor patch to the Management Pack Collector service
Review membership of the Veeam Virtualization Extensions Users group and remove unnecessary accounts
What the sources say 4
· Mastodon: “A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.” Source
· Mastodon: “A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.” Source
· Mastodon: “A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.” Source
· Mastodon: “Veeam patched eight vulnerabilities, including a critical authorization bypass (CVE-2026-108142) and a SQL injection flaw (CVE-2026-106076) that allows remote code execution.” Source