CVE-2026-106078
Published on October 27, 2026
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Weakness Type
Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Versions
Veeam Backup for Microsoft 365:- Version 8.0, <= 8.6.0.1102 is affected.