Backup For Microsoft 365
Monthly
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.