Veeam Management Pack: Remote code execution in Collector service
Summary
The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.
Affected
- Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch
- Unsupported product versions were not tested but are likely affected
- Only installations with the Collector service are affected
Fixed in
- Veeam Management Pack for Microsoft System Center 13.1, build 13.1.0.334 or later
Workaround
Unknown. No workaround or mitigation for version 9.x is documented; the only documented remedy is upgrading to 13.1.0.334.
Exploitation
- No public proof-of-concept exploit confirmed as of this research
- Not listed in the CISA KEV catalog
- Discovered by Veeam during internal testing
- Veeam warns that attackers will likely try to reverse-engineer the patch
- CVSS 4.0 base score 8.7 (High); CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Inventory all Veeam Management Pack installations and check whether the Collector service is deployed
- Flag all 9.x installations for migration, since no patch will be provided for version 9.x
- Upgrade to 13.1.0.334 or later, prioritising Collector servers and the related CVE-2023-22793 fix in the same release
- Until patched, restrict domain accounts with access to these servers and review administrative rights
- Monitor these hosts for unexpected service or process activity and new local accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4961 Vulnerabilities Resolved in Management Pack 13.1 www.veeam.com
- VulDB CVE-2026-107238 vuldb.com
- TheHackerWire CVE-2026-107238 www.thehackerwire.com
- SecurityOnline Veeam vulnerabilities securityonline.info
- ThreatInt CVE-2026-107238 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:34.
Original description (NVD)
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.