Vulnerability · Published Oct 27, 2026 · Assigned by hackerone
CVE-2026-106078
Medium 6.9
In plain English
A medium-severity security flaw in Backup for Microsoft 365 from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 82.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup for Microsoft 365 | 8.0 – through 8.6.0.1102 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N