Advisory · CVE-2026-106076
SQL injection between Veeam Backup for Microsoft 365 servers can cross tenants and execute code
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 contains an SQL injection flaw that lets an authenticated organization-transfer peer inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. CVSS 4.0 9.0.
- Vendor
- Veeam
- Product
- Veeam Backup for Microsoft 365
- Identifier / CWE
- CVE-2026-106076
CWE-89 - Action timing
- Immediate
Explain it like I’m five
Backup servers that hand organizations between each other are supposed to check in as trusted peers. One peer can hide database commands in that conversation, and the receiving server runs them against its own configuration, spilling other tenants' data.
- 01Peer connection established
An authenticated organization-transfer peer connects to a Veeam Backup for Microsoft 365 server running 8.0 through 8.5.0.1014.
- 02SQL injected
The peer injects SQL into the transfer conversation that reaches the source server's configuration database.
- 03Cross-tenant access gained
The injected SQL reads and writes configuration data belonging to other tenants.
- 04Code executes
Per the record, the injection leads to remote code execution as the PostgreSQL service account.
What happened
Veeam published CVE-2026-106076 on October 27, 2026 in KB4957, rated critical at CVSS 4.0 9.0: a vulnerability allowing an authenticated organization-transfer peer to inject SQL (CWE-89) into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
The record lists Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014 as affected. The record does not name a fixed version number, so apply the update provided in KB4957 rather than assuming one.
What to do
- Inventory Veeam Backup for Microsoft 365 servers, including any that accept organization transfers, and note versions.
- Apply the update provided in Veeam KB4957 to every server running 8.0 through 8.5.0.1014.
- Until updated, restrict organization-transfer peer relationships and network access to backup servers to known peers only.
- Review configuration database and server logs for unexpected transfers, configuration reads or changes, and new operators.
- Rotate backup service credentials, Microsoft 365 app secrets, and encryption keys if suspicious peer activity cannot be excluded.
- Verify the deployed build after updating.
Management note
Backup infrastructure is the recovery plan and a top target in its own right, and a cross-tenant flaw in it breaks the isolation customers are paying for. Patch it on the incident clock, and audit peer relationships the way you audit federation trusts.