Veeam Management Pack: Unauthenticated remote code execution in Virtualization Extensions
Summary
The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.
Affected
- Veeam Management Pack for Microsoft System Center 9.0 to before 13.1.0.334 (per CISA SSVC and third-party trackers)
- Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds according to KB4961
- Unsupported versions were not tested but are likely affected
- Version 8.0 is reported by one tracker; not confirmed by the vendor
- Default configuration: unaffected (per CVE record)
Fixed in
- Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334)
- No fix is provided for version 9.x; upgrade to 13.1.0.334
Workaround
Unknown.
- No vendor-published workaround is known for this CVE.
- Restrict network access to the Virtualization Extensions service to required management hosts (unverified by the vendor).
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in the CISA KEV catalog according to third-party trackers.
- No public proof-of-concept exploit known at the time of writing.
- Veeam warns that attackers may attempt to reverse-engineer the patch to attack unpatched systems.
Our recommendation
- Inventory all installations of the Veeam Management Pack and their versions.
- Upgrade all 9.x installations to 13.1.0.334 and check the 13.x compatibility requirements in the release notes.
- If an upgrade is not possible, restrict the service port to known management hosts and monitor for unexpected connections.
- Review the companion CVEs CVE-2026-107239 and CVE-2026-107238 in the same patch cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1 www.veeam.com
- VulDB CVE-2023-22793 vuldb.com
- VulDB vulnerability 428795 vuldb.com
- Strix AI CVE-2023-22793 www.strix.ai
- ThreatINT CVE-2023-22793 cve.threatint.com
- TheHackerWire CVE-2023-22793 www.thehackerwire.com
- SecurityOnline Veeam vulnerabilities report securityonline.info
- Veeam Helpcenter: New VEConnection helpcenter.veeam.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:26.
Original description (NVD)
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.