Veeam Management Pack CVE-2026-107239

Attacker must be an authenticated member of the 'Veeam Virtualization Extensions Users' group, and the target must be a server running the Collector service of Veeam Management Pack for Microsoft System Center in an affected version (9.0 up to but not including 13.1.0.334). The CVSS 4.0 vector also indicates a passive user interaction is required (UI:P) and a specific attack requirement/condition must be met (AT:P), both of which limit opportunistic exploitation. Limiting factors: this is not remotely exploitable by anonymous/unauthenticated attackers (PR:L), installations already on 13.1.0.334 or later are not affected, and the precise path-traversal trigger is not documented in the available sources.

The CVSS 4.0 base score of 8.8 is driven by high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) plus a subsequent-system scope change (SC:H), reflecting full remote code execution on the Collector server. However, several metrics temper real-world risk: exploitation requires valid low-level privileges (PR:L) - specifically membership in the 'Veeam Virtualization Extensions Users' group - plus a passive user interaction (UI:P) and a distinct attack requirement/condition (AT:P), so this is NOT an unauthenticated drive-by. There is no KEV listing and no EPSS score was provided, and no PoC or exploit reference appears in the input, so the exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patched, responsibly-disclosed (HackerOne) flaw that warrants prompt but not emergency remediation. Net: a genuine high-severity RCE worth patching this week for anyone running the affected product, but the privileged-group + interaction prerequisites make mass, widespread exploitation unlikely relative to the raw 8.8 score.

A user who already holds membership in the Veeam Virtualization Extensions Users group targets a server running the Veeam Management Pack for Microsoft System Center Collector service and abuses a relative path traversal weakness (CWE-23) to achieve remote code execution. CVSS indicates low attack complexity (AC:L) but requires that group privilege (PR:L), a specific attack condition (AT:P) and passive user interaction (UI:P); the exact trigger is not described in the available sources. No public exploit identified at time of analysis.