Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1120
_____________________________________________________________________

DATE                : 04/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Veeam Management Pack for Microsoft
                System Center versions prior to 13.1 (build 13.1.0.334).

====================================================================
https://www.veeam.com/kb4961
_____________________________________________________________________


Vulnerabilities Resolved in Veeam Management Pack for Microsoft
System Center 13.1

KB ID: 	4961
Product: 	Veeam Management Pack | 9.0 | 9a
Published: 	2026-10-29
Last Modified: 	2026-10-29

Veeam Software Security Commitment
Veeam® is committed to ensuring its products protect customers from
potential risks. As part of that commitment, we operate a
Vulnerability Disclosure Program (VDP) for all Veeam products and
perform extensive internal code audits. When a vulnerability is
identified, our team promptly develops a patch to address and mitigate
the risk. In line with our dedication to transparency, we publicly
disclose the vulnerability and provide detailed mitigation information.
This approach ensures that all potentially affected customers can
quickly implement the necessary measures to safeguard their systems.
It’s important to note that once a vulnerability and its associated
patch are disclosed, attackers will likely attempt to reverse-engineer
the patch to exploit unpatched deployments of Veeam software. This
reality underscores the critical importance of ensuring that all
customers use the latest versions of our software and install all
updates and patches without delay.


Issue Details
CVE-2026-107239

A vulnerability allowing a member of the Veeam Virtualization
Extensions Users group to perform remote code execution (RCE) on
servers running the Veeam Management Pack for Microsoft System
Center Collector service.

Severity: High
CVSS v4.0 Score: 8.8
Source: Discovered during internal testing.
Affected Product

    Veeam Management Pack for Microsoft System Center 9.1 and all
earlier version 9 builds, including the Veeam Backup & Replication
13 compatibility patch.
    Note: A fix will not be provided for version 9.x. Customers
running version 9.x should upgrade to 13.1.0.334.
    Note: Unsupported product versions were not tested, but are
likely affected and should be considered vulnerable.


Solution

This vulnerability was fixed starting in the following build:

    Veeam Management Pack for Microsoft System Center 13.1
(build 13.1.0.334)

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform
remote code execution (RCE) as the LocalSystem account on servers
running the Veeam Management Pack for Microsoft System Center
Collector service.

Severity: High
CVSS v4.0 Score: 8.7
Source: Discovered during internal testing.
Affected Product

    Veeam Management Pack for Microsoft System Center 9.1 and all
earlier version 9 builds, including the Veeam Backup & Replication
13 compatibility patch.
    Note: A fix will not be provided for version 9.x. Customers
running version 9.x should upgrade to 13.1.0.334.
    Note: Unsupported product versions were not tested, but are
likely affected and should be considered vulnerable.

Solution

This vulnerability was fixed starting in the following build:

    Veeam Management Pack for Microsoft System Center 13.1
(build 13.1.0.334)


CVE-2023-22793

A vulnerability allowing an unauthenticated attacker to perform
remote code execution (RCE) on servers running the Veeam
Virtualization Extensions service of Veeam Management Pack for
Microsoft System Center.

Severity: Critical
CVSS v4.0 Score: 9.3
Source: Discovered during internal testing.

Affected Product

    Veeam Management Pack for Microsoft System Center 9.1 and
all earlier version 9 builds, including the Veeam Backup &
Replication 13 compatibility patch.
    Note: A fix will not be provided for version 9.x. Customers
running version 9.x should upgrade to 13.1.0.334.
    Note: Unsupported product versions were not tested, but are
likely affected and should be considered vulnerable.

Solution

This vulnerability was fixed starting in the following build:

    Veeam Management Pack for Microsoft System Center 13.1
(build 13.1.0.334)

If this KB article did not resolve your issue or you need further
assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link:
Send Article Feedback

To report a typo on this page, highlight the typo with your mouse
and press CTRL + Enter.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================