Veeam Backup for Microsoft 365: Arbitrary file read by Administrator-role user
Summary
A flaw in Veeam Backup for Microsoft 365 allows a user with the Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges. The attack is possible over the network with low complexity, but it requires a valid Administrator-role account. A compromised or malicious administrator account could expose sensitive files and data on the backup server.
Affected
- Veeam Backup for Microsoft 365 8.0 to 8.5.0.1014 (all earlier version 8 builds)
- Unsupported versions were not tested but are likely affected.
Fixed in
- Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102), according to KB4957 for this CVE
- A third-party summary recommends 8.6 Patch 1 (build 8.6.0.5011); verify the fixed build in KB4957 before rollout.
Workaround
- Unknown. No vendor workaround for this CVE was found in the sources.
Exploitation
- Not known to be exploited at the time of research.
- No public proof of concept found.
- Not confirmed in CISA KEV in one source; re-check the catalog.
Our recommendation
- Upgrade Veeam Backup for Microsoft 365 to version 8.6 or later, preferably 8.6 Patch 1, after verifying the build in KB4957.
- Review and limit who holds the Backup for Microsoft 365 Administrator role.
- Keep the backup server and its console off the internet and out of general user networks.
- Monitor administrator activity and file access on the backup server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4957 www.veeam.com
- PSIRT CVE-2026-106077 psirt.com
- Strix CVE-2026-106077 www.strix.ai
- Securityonline Veeam advisory summary securityonline.info
- Cystack Veeam vulnerability database cystack.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:11.
Original description (NVD)
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.