Veeam Backup for Microsoft 365 CVE-2026-106077

Exploitation requires the attacker to already possess the Veeam Backup for Microsoft 365 Administrator role on the product console - a high-privilege, authenticated position (PR:H), not anonymous access. Given that, the flaw lets the admin read arbitrary files on the backup server with LocalSystem privileges over the network with low complexity and no user interaction. Limiting factors: only deployments running Backup for Microsoft 365 version 8.0 up to and including 8.5.0.1014 are affected per EUVD; exploitation is gated on obtaining or abusing Administrator-level credentials, so realistic risk centers on insider misuse or a compromised backup-admin account rather than external unauthenticated attackers.

This is a real but conditional priority, not a drive-by threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, base 8.3) and CWE-863 (Incorrect Authorization) agree that exploitation requires an already-authenticated, high-privilege actor: specifically a holder of the Veeam Backup for Microsoft 365 Administrator role (PR:H). The payoff is high - arbitrary file read executed with LocalSystem privileges, crossing from the application's authorization boundary into the host OS, which the vector reflects as subsequent-system impact (SC:H). The vuln.today decision label is 'this_week', consistent with a serious issue that is not an active-exploitation emergency. There is no CISA KEV listing, no EPSS probability supplied, and no PoC or exploit reference in the input, so there is no public exploit identified at time of analysis - the risk is driven by severity and privilege-escalation potential, not by observed exploitation. One signal conflict to flag: the supplied 4.0 vector asserts subsequent-system integrity impact (SI:H), but the description only states arbitrary file READ, which is a confidentiality action - verify with Veeam whether any write/integrity effect actually exists. Net: patch within the vendor's/decision-label window; the PR:H barrier limits mass exploitation but a compromised or malicious backup admin can fully escalate to LocalSystem host access.

An authenticated Veeam Backup for Microsoft 365 operator who holds the Administrator role (or an attacker who has phished/stolen those credentials) abuses the authorization flaw to request files outside the application's intended scope. Because the read executes with LocalSystem privileges, they retrieve sensitive OS files - service credentials, configuration secrets, or other backup-related data - from the backup server. No public exploit is identified at time of analysis, so this would require manual abuse of the management interface rather than a turnkey tool.