CVE-2026-107239
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Risk Assessment
A low-privileged user could escalate control over the server, potentially compromising the entire monitoring environment.
Recommendation
Update Veeam Management Pack for Microsoft System Center to a patched version and review membership of the Veeam Virtualization Extensions Users group.
Other vulnerabilities in Veeam Management Pack for Microsoft System Center
See all- CVE-2023-22793Critical
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
- CVE-2026-107238High
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Original NVD description (English source)
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS