Veeam Backup M365 CVE-2026-106078

Exploitation requires network reachability to the Veeam Backup for Microsoft 365 REST API and the ability to present a forged federation token that the server fails to verify (CWE-347); per the vector this needs no authentication (PR:N) and no user interaction (UI:N). The key LIMITING factor stated in the evidence is scope of access: the bypass only returns responses from REST API endpoints that do NOT call the backup service, so impact is confined to that endpoint subset and to confidentiality (VC:L) - no integrity or availability impact and no access to backup-service operations. Realistic exposure is therefore gated by whether the REST API is accessible to the attacker (e.g. internet-facing vs. internal-only deployment). The precise cryptographic flaw enabling the forgery is not described in the available sources.

This is a genuine but moderate-priority issue, not a high-CVSS scare. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with no user interaction, which on its face is attractive to attackers; however, the impact metrics are deliberately narrow: VC:L with VI:N and VA:N, meaning limited confidentiality exposure only and no integrity or availability impact. The description reinforces this - the forged federation token (CWE-347, improper verification of a cryptographic signature) only yields responses from REST API endpoints that do NOT call the backup service, so the attacker reads a restricted subset of API data rather than gaining control of backups. No EPSS score is provided in the input, so exploitation probability cannot be quantified; the vulnerability is not listed in CISA KEV and no public exploit reference is supplied, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a moderate-severity, unauthenticated-but-limited-impact disclosure flaw. Net: patch on a normal expedited cycle rather than as an emergency, but note that the unauthenticated network vector and authentication-bypass nature warrant attention if the REST API is network-exposed.

A remote, unauthenticated attacker with network access to the Veeam Backup for Microsoft 365 REST API crafts a forged federation token whose signature is not properly verified, and submits it to the API. The bypass lets the attacker receive responses from REST API endpoints that do not invoke the backup service, disclosing limited information without any credentials. No public exploit has been identified at time of analysis; the trigger mechanism beyond 'forged federation token' is not detailed in the available sources.