Veeam Management Pack CVE-2026-107238

Exploitation requires (1) a valid authenticated domain user account - the CVSS vector's PR:L confirms authentication is needed, so this is not exploitable by fully unauthenticated attackers; and (2) network reachability of the Veeam Management Pack for Microsoft System Center Collector service, meaning only hosts running that Collector role are affected. The vulnerable deserialization path (CWE-502) exists in Management Pack for Microsoft System Center versions 9.0 through below 13.1.0.334; version 13.1.0.334 and later are not affected. Limiting factors: the domain-authentication requirement and the fact that only the Collector service (a specific component, not every Veeam or SCOM install) is exploitable reduce the exposed population; no user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has domain credentials and network access to the Collector, exploitation is straightforward. The exact crafted-input trigger is not described in the available sources.

This is a credible, near-term priority rather than inflated-CVSS noise, but it is not a drop-everything emergency on current signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges - consistent with the description's 'authenticated domain user' - yielding full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) because code runs as LocalSystem. The CWE-502 deserialization class is historically reliable to exploit once reachable, which supports the 8.7 severity. However, the input provides NO EPSS score and NO CISA KEV listing, so there is no quantitative exploitation-probability or active-exploitation signal to corroborate the severity. No confirmed public exploit is present either; 'Reported by: hackerone' identifies the disclosure channel, not a published PoC. The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with a serious but authentication-gated flaw. Net: treat as a prompt-patch item because the PR:L barrier (any valid domain account) is low in most enterprise environments, while noting that the absence of EPSS/KEV/PoC evidence means exploitation likelihood is currently unquantified rather than confirmed low.

An attacker who already holds any valid domain user account reaches the Veeam Management Pack Collector service over the network and submits a crafted serialized object that the service deserializes unsafely (CWE-502). Because the service runs as LocalSystem, successful deserialization yields remote code execution at the highest local privilege, giving full control of the monitoring server. No public exploit is identified at time of analysis, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:L/UI:N) and the stated deserialization weakness rather than from observed exploit code.