CVE-2026-106076 in Backup for Microsoft 365
Summary
by MITRE • 10/27/2026
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability represents a critical security flaw within the architecture of Veeam Backup for Microsoft 365, specifically targeting the interaction between organization-transfer peers during backup operations. This issue stems from an SQL injection weakness located in the configuration database handling mechanisms of the source server. The root cause lies in insufficient input validation and sanitization processes when processing data submitted by authenticated users with organization-transfer peer privileges. An attacker possessing these specific credentials can craft malicious SQL payloads that are executed directly against the underlying PostgreSQL database engine, bypassing intended logical controls designed to isolate tenant-specific configuration data.
The operational impact of this vulnerability is severe due to its potential for both unauthorized data access and complete system compromise. By exploiting the injection point, an adversary can perform cross-tenant read operations, effectively breaching the multi-tenancy isolation model that protects customer data from being accessed by other organizations within the same deployment environment. This leads to a significant confidentiality breach where sensitive configuration details, potentially including connection strings or authentication tokens for external services, are exposed. Furthermore, the vulnerability allows for write access to the configuration database, enabling an attacker to alter system settings and persist malicious configurations that can facilitate further attacks or disrupt service availability.
Beyond data exfiltration and manipulation, this flaw enables remote code execution with elevated privileges. Since Veeam Backup for Microsoft 365 typically runs its backend services under a dedicated PostgreSQL service account, successful exploitation allows the attacker to execute arbitrary commands on the host system using the permissions associated with that database process. This escalation of privilege transforms a simple data breach into a full infrastructure compromise, granting the adversary control over the backup server itself. The ability to run code as the database service account often provides access to file systems, network interfaces, and other local resources, significantly expanding the attack surface for lateral movement within the organization's internal network.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The exploitation path involves manipulating input data to alter database queries, which is a classic pattern documented in industry standards for web and application security flaws. In terms of tactical behavior, the initial access phase corresponds to ATT&CK technique T1078 Valid Accounts, as it requires legitimate but potentially compromised or misconfigured credentials with specific peer roles. The subsequent actions involving data exfiltration map to ATT&CK technique T1530 Data from Cloud Storage Object Database, while the remote code execution aspect relates to techniques such as T1059 Command and Scripting Interpreter if scripts are deployed via the database interface, or general privilege escalation vectors depending on the specific exploitation method used against the PostgreSQL service.
Mitigation strategies must focus on immediate remediation through vendor patches and rigorous access control reviews. Organizations should apply the latest security updates provided by Veeam as soon as they become available to address the input validation deficiencies in the configuration database handling code. In parallel, administrators should audit user roles and permissions within the Veeam Backup for Microsoft 365 environment, ensuring that organization-transfer peer privileges are granted only to trusted individuals or service accounts with a strict need-to-know basis. Implementing network segmentation to restrict access to the backup servers from untrusted networks can also reduce the risk of exploitation by limiting the attack surface exposed to potential adversaries. Additionally, monitoring database logs for anomalous SQL query patterns and unusual privilege escalations associated with the PostgreSQL service account can aid in early detection of attempted exploits before full system compromise occurs.