Veeam M365 Backup EUVD-2026-111123

Exploitation requires the attacker to be an authenticated organization-transfer peer of the target, and the organization-transfer functionality must be in use on the source Veeam Backup for Microsoft 365 server - this is the concrete precondition reflected by PR:L (authenticated) and AT:P (attack requirement present) in the CVSS 4.0 vector. Affected deployments are Backup for Microsoft 365 8.0 through 8.5.0.1014. The limiting factor is that an anonymous or merely network-adjacent attacker cannot reach the flaw; a legitimate organization-transfer peer relationship is needed, which narrows exploitation to configured multi-tenant/transfer scenarios rather than default standalone installations.

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 4.0 base score of 9.0 reflects network reach (AV:N), low complexity (AC:L), only low privileges (PR:L), no user interaction (UI:N), full high impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with SQL injection (CWE-89) that yields cross-tenant configuration read/write and remote code execution as the PostgreSQL service account. The vuln.today decision label is act_now, which signals urgent remediation. However, several exploitation signals are absent: no EPSS probability is provided, the CVE is not listed in CISA KEV, and the references (Veeam KB4957 and the NVD/EUVD advisory) contain no proof-of-concept - so there is no public exploit identified at time of analysis. The one tempering factor is AT:P (Attack Requirements: Present): exploitation is not against arbitrary users but requires the attacker to hold an authenticated organization-transfer peer relationship, so the realistic threat population is other tenants/peers participating in organization transfer rather than anonymous internet attackers. Net: treat as act_now per the decision label given the critical technical impact and multi-tenant blast radius, while noting that active exploitation is not confirmed and the privilege/peer precondition narrows who can attack.

An attacker who already holds authenticated organization-transfer peer access to a Veeam Backup for Microsoft 365 server injects crafted SQL through the organization-transfer path into the source server's PostgreSQL configuration database. Because the injection runs in the database service context, the attacker reads and modifies other tenants' configuration data and achieves remote code execution as the PostgreSQL service account. No public exploit code was identified in the provided sources.