CVE-2026-106076: Veeam Backup for Microsoft 365 Cross-Tenant SQL Injection

Executive Summary & Technical Impact

A critical SQL injection flaw in Veeam Backup for Microsoft 365 allows an authenticated organization-transfer peer to inject arbitrary SQL queries into the source server’s PostgreSQL configuration database, leading to cross-tenant configuration read/write and code execution under the PostgreSQL service account.

Tracked under CVE-2026-106076 (CWE-89 (SQL Injection)), this vulnerability affects Veeam Backup for Microsoft 365 < 8.6 Patch 1 (8.6.0.5011) and carries a severity score of 9.0 (CRITICAL). Engineering and security operations teams running Veeam Backup for Microsoft 365 should prioritize upgrading to Veeam Backup for Microsoft 365 8.6 P1 (build 8.6.0.5011).

Remediation & Patch Guidance

1. Upgrade Veeam Backup for Microsoft 365 to version 8.6 Patch 1 (build 8.6.0.5011) immediately, especially in multi-tenant service provider deployments.
2. Restrict network reachability of organization-transfer and REST API ports to explicitly allowlisted tenant peers.

Frequently Asked Questions (CVE-2026-106076)

What versions are affected by CVE-2026-106076?

CVE-2026-106076 affects Veeam Backup for Microsoft 365 < 8.6 Patch 1 (8.6.0.5011) in Veeam Backup for Microsoft 365 (Veeam Backup for Microsoft 365 Cross-Tenant SQL Injection).

How do I patch or remediate CVE-2026-106076?

Upgrade affected deployments to Veeam Backup for Microsoft 365 8.6 P1 (build 8.6.0.5011) and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-106076?

CVE-2026-106076 is rated CRITICAL with a CVSS score of 9.0 (vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).