Veeam fixes three code-execution flaws in its System Center pack

Veeam fixes three code-execution flaws in its System Center pack

29 October 2026: Veeam has fixed three remote code execution flaws in its Management Pack for Microsoft System Center, the most serious rated Critical (CVSS v4.0 9.3) and open to an attacker who is not logged in. The fixes ship only in version 13.1, build 13.1.0.334, and Veeam says plainly that "a fix will not be provided for version 9.x". It reports no exploitation, and all three were found in its own internal testing.

Not yet independently verified. This rests on Veeam's own knowledge base article. The third flaw is printed there as CVE-2023-22793, an unusual number for an issue found this year, and we have not yet found an NVD record or a second source that confirms the identifier. We will update this when it can be confirmed, and remove this note.

Three flaws, two services

The Management Pack feeds Veeam backup and virtualisation health into Microsoft System Center Operations Manager. Two of its services are affected:

• CVE-2023-22793 (Critical, 9.3): an unauthenticated attacker can run code on servers running the Veeam Virtualization Extensions service.
• CVE-2026-107239 (High, 8.8): a member of the Veeam Virtualization Extensions Users group can run code on servers running the Collector service.
• CVE-2026-107238 (High, 8.7): any authenticated domain user can run code as the LocalSystem account on servers running the Collector service.

The last one matters more than its score suggests. "Authenticated domain user" means any account in Active Directory, so a phished workstation login is enough to reach SYSTEM on the monitoring server, and monitoring servers usually hold credentials for everything they watch.

Version 9 is a dead end

Every affected build is version 9.1 or earlier in the 9 line, including the compatibility patch Veeam released so that version 9 could work with Veeam Backup & Replication 13. That patch was how many customers kept the old pack running after moving their backup servers to version 13; it does not protect them here. Veeam adds that unsupported versions were not tested but should be treated as vulnerable.

Moving from 9.x to 13.1 is an upgrade of the management pack itself rather than a hotfix, so it needs the usual System Center change window: import the new pack, check that the Collector and Virtualization Extensions services come back, and confirm the dashboards still populate.

If the upgrade has to wait

Veeam publishes no workaround. Until the upgrade is done, the exposure can be narrowed in two ways that follow from how the flaws work: limit network access to the servers running the Virtualization Extensions and Collector services to the System Center hosts that need them, and review who sits in the Veeam Virtualization Extensions Users group. Neither removes the unauthenticated flaw on a reachable server.

Veeam's advisory carries its usual warning that attackers tend to reverse-engineer a fix once it is published, which is why its backup products have repeatedly appeared in exploitation reports within weeks of a patch. Two Backup & Replication advisories this week, the CDP coordinator bypass and the Backup Viewer flaw in 12.3.2, cover the backup servers themselves.

Veeam in our backup category

Our server backup category lists 20 products. Veeam publishes its fixes through numbered knowledge base articles, and KB4961 was published and last modified on the same day, so there has been no revision since release.

Company profile on TrustList: Veeam

Related on TrustList:

• Veeam fixes a critical authorization bypass in Backup & Replication 13
• AhsayCBS backup flaws exploited to plant miners, no patch confirmed
• Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes

Sources

• Veeam KB4961: Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1, 29 October 2026