CERT-FR flags multiple Veeam Backup for Microsoft 365 flaws, including remote code execution (CVE-2025-64394 and others)
CERT-FR published advisory CERTFR-2026-AVI-1411 on 29 October 2026 about multiple vulnerabilities in Veeam Backup for Microsoft 365 version 8.x. Some of them allow remote arbitrary code execution, privilege escalation and loss of data confidentiality. The advisory relays Veeam security bulletin kb4962 of 28 October 2026. It does not report active exploitation, threat actors or IOCs.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1411 reports multiple vulnerabilities in Veeam Backup for Microsoft 365 8.x, listed as CVE-2025-64394, CVE-2026-106076, CVE-2026-106077 and CVE-2026-106078. Some allow remote arbitrary code execution, privilege escalation and loss of data confidentiality, plus security policy bypass. The advisory does not map each CVE to an impact, nor state attack vector, authentication or configuration requirements. Affected: 8.x before 8.6.0.1102, and 8.x after 8.6.0.1102 and before 8.6.0.5011. The ranges imply 8.6.0.5011 or later is fixed.
Como funciona
The articles do not describe how the vulnerable process works. They give no input, component or step at which the software fails for any of the four CVEs, so no mechanism can be explained without guessing. Details are said to be in Veeam bulletin kb4962, which was not included in the source material.
Por que é vulnerável
The root cause is not stated in the articles. The CERT-FR advisory only lists impacts and affected versions, and says fixes are obtained through the vendor bulletin. What the fix changes is not described.
Como foi descoberta
The articles do not say who found the flaws or how. CERT-FR published its advisory on 29 October 2026, relaying Veeam security bulletin kb4962 of 28 October 2026. The advisory does not report active exploitation, threat actors or IOCs.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 14:22.
Detalhes técnicos
- Impacts listed: breach of data confidentiality, security policy bypass, remote arbitrary code execution.
- Affected: Veeam Backup for Microsoft 365 8.x versions before 8.6.0.1102.
- Affected: Veeam Backup for Microsoft 365 8.x versions after 8.6.0.1102 and before 8.6.0.5011.
- CVEs referenced: CVE-2025-64394, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078.
- The advisory does not map each CVE to a specific impact, nor does it give the attack vector or authentication requirements.
Remediação
- Apply the fixes described in Veeam bulletin kb4962 (https://www.veeam.com/kb4962).
- Upgrade to a build at or above 8.6.0.5011, as the affected ranges in the advisory imply.
Linha do tempo
-
CERT-FR flags multiple Veeam Backup for Microsoft 365 flaws, including remote code execution (CVE-2025-64394 and others)
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1411 on 29 October 2026 about multiple vulnerabilities in Veeam Backup for Microsoft 365 version 8.x. Some of them allow remote arbitrary code execution, privilege escalation and loss of data confidentiality. The advisory relays Veeam security bulletin kb4962 of 28 October 2026. It does not report active exploitation, threat actors or IOCs.
Technical Details
- Impacts listed: breach of data confidentiality, security policy bypass, remote arbitrary code execution.
- Affected: Veeam Backup for Microsoft 365 8.x versions before 8.6.0.1102.
- Affected: Veeam Backup for Microsoft 365 8.x versions after 8.6.0.1102 and before 8.6.0.5011.
- CVEs referenced: CVE-2025-64394, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078.
- The advisory does not map each CVE to a specific impact, nor does it give the attack vector or authentication requirements.
Remediation
- Apply the fixes described in Veeam bulletin kb4962 (https://www.veeam.com/kb4962).
- Upgrade to a build at or above 8.6.0.5011, as the affected ranges in the advisory imply.