CVE-2026-107238

Received Received - Intake

Veeam Management Pack RCE via LocalSystem Account

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: HackerOne

Description

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-107238

EUVD

EUVD-2026-113416

Affected Vendors & Products

Vendor	Product	Version / Range
Veeam	Management Pack for Microsoft System Center	9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated domain user to execute remote code on servers running the Veeam Management Pack for Microsoft System Center Collector service with LocalSystem privileges. This means an attacker with valid credentials could gain full control over affected servers.

Impact Analysis

An attacker could exploit this to take over servers running the vulnerable service, leading to data breaches, unauthorized access to sensitive systems, or disruption of services. The LocalSystem account provides high privileges, increasing the potential damage.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face fines or penalties if they fail to protect systems adequately.

Mitigation Strategies

Immediately apply the latest security patches or updates provided by Veeam for the Management Pack service. Disable the Veeam Management Pack for Microsoft System Center Collector service if not required. Restrict domain user access to only necessary systems and services.

Hi! I’m here to help you understand CVE-2026-107238. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70