Veeam Management Pack for Microsoft System Center: Remote code execution
Summary
The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.
Affected
- Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch (CNA range: 9.0 to before 13.1.0.334)
- Unsupported versions were not tested but are likely affected according to Veeam
- Version 8.x is not named by Veeam; assume it is affected until confirmed
Fixed in
- Veeam Management Pack for Microsoft System Center 13.1, build 13.1.0.334
- No fix for version 9.x; upgrade to 13.1.0.334
Workaround
Unknown. Veeam lists no workaround. Third-party suggestion (not vendor-confirmed): review membership of the Veeam Virtualization Extensions Users group and remove accounts that only need monitoring.
Exploitation
- Not listed in CISA KEV; CISA SSVC assessment: exploitation none, not automatable
- No public proof of concept found in the sources checked
- Veeam warns that attackers will likely try to reverse-engineer the patch
- One report mentions attack traffic for this CVE, but the source does not confirm it; treat exploitation as unconfirmed
Our recommendation
- Upgrade the Management Pack to 13.1.0.334
- Migrate version 9.x installations to 13.1, because no fix is provided for 9.x
- Review membership of the Veeam Virtualization Extensions Users group now and remove unneeded accounts
- Check whether System Center Operations Manager with this management pack is in use; without it, this CVE does not apply
- Patch CVE-2023-22793 first, then CVE-2026-107238 and CVE-2026-107239, which are fixed in the same build
- Recheck CISA KEV and NVD over the coming days, as the record is new
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4961: Vulnerabilities Resolved in Management Pack 13.1 www.veeam.com
- VulDB: CVE-2026-107239 vuldb.com
- ThreatInt: CVE-2026-107239 cve.threatint.com
- Positive Technologies PT-2026-132855 (CVE-2023-22793) vulners.com
- SecurityOnline: Veeam vulnerabilities in Management Pack securityonline.info
- TheHackerWire: CVE-2026-107239 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:57.
Original description (NVD)
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.