The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.
Veeam · Management Pack for Microsoft System Center
The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.
Veeam · Management Pack for Microsoft System Center
The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.
Veeam · Management Pack for Microsoft System Center
Veeam Backup & Replication 13 contains a critical authorization bypass in the CDP Coordinator Service, which runs on the backup server and coordinates Continuous Data Protection tasks. An unauthenticated remote attacker can bypass authorization checks over the network without user interaction. Veeam's advisory reports high impact on integrity and availability, and the research notes indicate no direct remote code execution. Exposure of the service to untrusted networks increases the risk considerably.
Veeam · Backup & Replication
An authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. Successful exploitation allows cross-tenant reading and writing of configuration data and remote code execution as the PostgreSQL service account. The attacker needs valid access as a configured organization-transfer peer, so the risk is highest for managed service providers hosting several customers on one backup server.
Veeam · Backup for Microsoft 365
