DFN-CERT advisory 2026-6097, dated October 28, 2026, reports potential vulnerabilities in Veeam Backup for Microsoft 365. It describes possible remote disclosure of information, security-control bypass and arbitrary code execution with the affected service’s privileges, as well as local file manipulation. The advisory identifies version 8.6 Patch 1, Build 8.6.0.5011, as a security update.
Potential effects described in the advisory
The reported remote vulnerabilities could expose information, bypass security measures or allow an attacker to run arbitrary code with the affected service’s privileges. A separate vulnerability could allow local file manipulation.
Exploitation conditions and update build
The advisory says the vulnerabilities have different privilege requirements, and that one requires user interaction. It also says successful exploitation of two vulnerabilities could affect other components.
The security update named in the advisory is Veeam Backup for Microsoft 365 8.6 Patch 1, Build 8.6.0.5011.
