CERT-FR Warns of Multiple RCE Vulnerabilities in Veeam Management Pack
The French CERT-FR published advisory CERTFR-2026-AVI-1426 regarding multiple vulnerabilities in Veeam Management Pack for Microsoft System Center, affecting versions prior to 13.1 (build 13.1.0.334). The flaws allow an attacker to achieve remote arbitrary code execution. No active exploitation is mentioned in the advisory. Users are advised to apply the vendor's patch as referenced in Veeam security bulletin kb4961.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1426 reports multiple vulnerabilities in Veeam Management Pack for Microsoft System Center that let an attacker achieve remote arbitrary code execution. The CVEs are CVE-2023-22793, CVE-2026-107238 and CVE-2026-107239, and the advisory gives no per-CVE detail or severity ranking. It does not say what access, authentication or configuration is needed. Versions before 13.1 (build 13.1.0.334) are affected, and 13.1.0.334 is the fixed version.
Como funciona
The articles do not describe how the vulnerable process works. They only say that the flaws allow remote code execution in the product. The input, the component that handles it and the step where it fails are not public in the sources provided.
Por que é vulnerável
The root cause is not stated in the advisory or in the story. Only the outcome, remote arbitrary code execution, is given. The vendor's bulletin kb4961 is the reference for what the fix changes, and its contents are not reproduced in the sources.
Como foi descoberta
The sources do not say who found the flaws or how. Veeam published security bulletin kb4961 on 29 October 2026, and CERT-FR issued its advisory referencing it on 30 October 2026. The advisory mentions no active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 12:19.
Detalhes técnicos
- Vulnerabilities enable remote code execution.
- Affected product: Veeam Management Pack for Microsoft System Center versions prior to 13.1 (build 13.1.0.334).
- Tracked as CVE-2023-22793, CVE-2026-107238, CVE-2026-107239.
- Reference: Veeam security bulletin kb4961 published 29 October 2026.
Remediação
- Update Veeam Management Pack for Microsoft System Center to version 13.1 (build 13.1.0.334) or later.
- Refer to Veeam's official security bulletin kb4961 for patch details.
Linha do tempo
-
CERT-FR Warns of Multiple RCE Vulnerabilities in Veeam Management Pack
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1426 regarding multiple vulnerabilities in Veeam Management Pack for Microsoft System Center, affecting versions prior to 13.1 (build 13.1.0.334). The flaws allow an attacker to achieve remote arbitrary code execution. No active exploitation is mentioned in the advisory. Users are advised to apply the vendor's patch as referenced in Veeam security bulletin kb4961.
Technical Details
- Vulnerabilities enable remote code execution.
- Affected product: Veeam Management Pack for Microsoft System Center versions prior to 13.1 (build 13.1.0.334).
- Tracked as CVE-2023-22793, CVE-2026-107238, CVE-2026-107239.
- Reference: Veeam security bulletin kb4961 published 29 October 2026.
Remediation
- Update Veeam Management Pack for Microsoft System Center to version 13.1 (build 13.1.0.334) or later.
- Refer to Veeam's official security bulletin kb4961 for patch details.