External risk intelligence

Veeam Backup for Microsoft 365 SQL Injection Allows Configuration Data Access and RCE

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-106076

This vulnerability affects a backup server component used for cross-tenant data management. While the network is involved, the requirement for an authenticated organization-transfer peer relationship indicates this is typically restricted to controlled, inter-organizational or internal infrastructure rather than a public-facing service exposed directly to the internet.

SQL Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Veeam Backup for Microsoft 365, specifically allowing an authenticated user to inject SQL code. This could potentially lead to unauthorized access and modification of configuration data across different tenants, and in some scenarios, allow for remote code execution. The primary concern at this level is confirming if your environment is affected and understanding the potential exposure.

Authenticated users can alter configurations.
Confirms if your backup environment is at risk.
Assess potential impact on tenant data integrity.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to transfer organization data could exploit this vulnerability. They would target the configuration database of the source Veeam Backup for Microsoft 365 server. Successful exploitation allows the attacker to read and write configuration data across tenants and potentially achieve remote code execution.

Authenticated access to transfer data.
Injecting SQL into the configuration database.
Tenant data compromise and code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated organization-transfer peer could inject SQL into the configuration database of a Veeam Backup for Microsoft 365 server. This could allow for unauthorized reading and writing of configuration data across different tenants managed by the server, and potentially enable remote code execution.

Configuration data and cross-tenant data.
SQL injection by an authenticated peer.
Unauthorized access and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Veeam Backup for Microsoft 365 infrastructure and its security posture should lead the response. The immediate priority is to identify all instances of the affected technology, determine their network reachability and business criticality, and confirm the ownership of each instance to prioritize remediation efforts.

Infrastructure and Security teams own this.
Verify affected server reachability and criticality.
Plan remediation based on risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Veeam Backup for Microsoft 365?

It is a software solution designed to protect data within Microsoft 365 environments, such as Exchange, SharePoint, and OneDrive. It manages backups across various organizational tenants and stores configuration settings in a PostgreSQL database to handle cross-tenant data operations.

How does CVE-2026-106076 work?

This vulnerability is a SQL injection, classified as CWE-89. It happens when untrusted data is improperly handled, allowing a user to insert malicious database commands. In this case, it targets the configuration database, potentially granting unauthorized access to tenant data and control over the service account running the database.

Do I need to be an administrator to trigger this bug?

You do not need full administrative rights, but you must be an authenticated organization-transfer peer. The bug is not triggered by casual web browsing or unauthenticated network traffic; it requires a specific, established relationship within the backup infrastructure to execute the injection.

Is my server at risk if it is not internet-facing?

According to Halo Surface Signal, this vulnerability is unlikely to be exploited from the public internet because it requires a specific, authenticated peer relationship. While internal networks are still at risk, the necessity of this pre-existing connection limits the potential attack surface compared to public-facing services.

How should I respond to this vulnerability?

First, identify all instances of Veeam Backup for Microsoft 365 within your environment. Verify who owns these servers and evaluate their network accessibility. Prioritize your response based on the criticality of the data managed by each instance and follow official vendor guidance to apply any available updates.

References

www.veeam.com/kb4957

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.