Veeam Backup for Microsoft 365: SQL injection in configuration database
Summary
An authenticated organization-transfer peer can inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server. Successful exploitation allows cross-tenant reading and writing of configuration data and remote code execution as the PostgreSQL service account. The attacker needs valid access as a configured organization-transfer peer, so the risk is highest for managed service providers hosting several customers on one backup server.
Affected
- Veeam Backup for Microsoft 365 8.0 up to and including 8.5.0.1014
- Unsupported builds were not tested but are likely affected according to the vendor
Fixed in
- Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102) per vendor advisory KB4957
- Veeam KB4913 states that the 8.6 release installs build 8.6.0.5011; whether this build includes the fix is not stated explicitly by the vendor and must be verified
Workaround
- Unknown. The vendor advisory gives no workaround; patching is the only confirmed fix.
- Interim hardening (third-party suggestion, not from the vendor): isolate the PostgreSQL service on the network and monitor it for anomalous SQL queries
Exploitation
- No public proof-of-concept found in research as of 31 Oct 2026
- Not listed in CISA KEV
- Unknown whether exploitation has been observed; the vendor advisory does not say
Our recommendation
- Update Veeam Backup for Microsoft 365 to version 8.6 (build 8.6.0.1102) or later, and verify the installed build
- Review the list of organization-transfer peers and remove any that are not needed
- Check whether the backup server is shared between several customers and prioritise patching accordingly
- Monitor PostgreSQL logs for unusual SQL queries until the update is applied
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 www.veeam.com
- Veeam KB4913 www.veeam.com
- Halo Security advisory CVE-2026-106076 cve.halosecurity.com
- OpenCVE CVE-2026-106076 app.opencve.io
- VulDB entry 427431 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:02.
Original description (NVD)
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.