Veeam published four vulnerabilities in Veeam Backup for Microsoft 365 on 27 October 2026, and the highest-scoring one ends in code execution on the backup server itself. The version 8 builds most organisations in this market still run are in scope.
What happened
CVE-2026-106076 is a SQL injection in the product's configuration database, rated 9.0 on CVSS v4.0. An authenticated organisation-transfer peer can inject SQL into the source server's configuration database, read and write configuration data across tenants, and execute code as the PostgreSQL service account.
Three more flaws shipped in the same batch. CVE-2026-106077 (8.3) lets a holder of the backup administrator role read arbitrary files on the server as LocalSystem. CVE-2026-106078 (6.9) lets an unauthenticated attacker bypass REST API authentication with a forged federation token. CVE-2025-64394 (4.3) lets a low-privileged local user write files with SYSTEM rights during installation.
Who is affected
Any Veeam Backup for Microsoft 365 version 8 server that has not been updated this week.
- CVE-2026-106076 and CVE-2026-106077: 8.5.0.1014 and all earlier version 8 builds.
- CVE-2026-106078 and CVE-2025-64394: 8.6.0.1102 and all earlier version 8 builds.
- Unsupported older version 8 builds were not tested by the vendor and should be treated as vulnerable.
- Veeam also shipped fixes for Backup and Replication, Veeam ONE and Agent for Linux in the same October batch.
What to do now
Upgrade to Veeam Backup for Microsoft 365 8.6 Patch 1, build 8.6.0.5011. Stopping at base 8.6 (8.6.0.1102) is not enough, because that build fixes only the first two issues.
- Check the installed build in the console under Help, then About, before assuming the server is current.
- Apply 8.6.0.5011 rather than 8.6.0.1102.
- Review who holds the backup Administrator role and which servers are configured as organisation-transfer peers, since two of the four flaws need that level of access.
- Restrict REST API and console reachability to the management network until the patch is on.
What this means for South African businesses
Microsoft 365 backup is one of the few products nearly every SME and every MSP here runs, and it usually sits on a single server that also holds the credentials to the tenant it protects. That makes it a high-value target rather than routine patching, because an attacker who lands on it reaches every mailbox it archives and the tenant credentials stored beside them.
My read is that the real exposure is not remote attackers but who already holds a login. CVE-2026-106076 needs an authenticated transfer peer, which in practice means someone with credentials, exactly the position a ransomware operator occupies after the first phishing success. The backup server is also the machine they most want to destroy, so patch it and audit the admin role list on the same day.
The vendor advisory with affected builds, vectors and fixed versions is Veeam KB4957 at veeam.com/kb4957.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.