# CVE-2026-106078: Veeam Backup for Microsoft 365 REST API authentication bypass

Source: https://junglewise.ai/threats/cve-2026-106078-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-106078 · Severity: info · Published 2026-10-27

Veeam Backup for Microsoft 365 is a backup solution protecting Microsoft 365 data for organizations. An unauthenticated attacker can forge a federation token to bypass REST API authentication and read sensitive configuration or backup data without valid credentials, potentially exposing organizational backup metadata.

Technologies: [Veeam Backup for Microsoft 365](https://junglewise.ai/threats/technologies/backup-for-microsoft-365). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-106078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106078 being exploited in the wild.

**How severe is CVE-2026-106078?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds.

**Is there a fix for CVE-2026-106078?** Yes: fixed in Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106078 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-106078?** Check whether you run Veeam Backup for Microsoft 365 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)

## Technical details

The vulnerability allows an unauthenticated attacker to bypass REST API authentication by forging a federation token, gaining read access to REST API endpoints that do not call the backup service. This is a broken authentication flaw affecting the REST API layer. An attacker can receive responses from the API without authentication; the affected versions are 8.6.0.1102 and all earlier version 8 builds.

## Affected products

- Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.veeam.com/kb4957](https://www.veeam.com/kb4957)

## Related threats

- [Veeam Backup for Microsoft 365 arbitrary file read in Admin role](https://junglewise.ai/threats/cve-2026-106077-a-vulnerability-allowing-a-user-with-the-veeam-backup-for)
- [Veeam Backup for Microsoft 365 SQL injection in configuration database](https://junglewise.ai/threats/cve-2026-106076-a-vulnerability-allowing-an-authenticated-organization-transfer)
- [Veeam Backup for Microsoft 365 privilege escalation during installation](https://junglewise.ai/threats/cve-2025-64394-a-vulnerability-allowing-a-low-privileged-local-user-to-write)