CVE WatchOct 29, 2026

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running t

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 29, 2026 · Last modified: Oct 29, 2026 · CWE-502

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

Official references

www.veeam.comhttps://www.veeam.com/kb4961

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2023-22793—

—

———A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.5h CVE-2026-621319.8 CRI

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.12h CVE-2026-620189.8 CRI

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.8h CVE-2026-620179.8 CRI

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.10h CVE-2026-620169.8 CRI

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.12h CVE-2026-620159.8 CRI

—

———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.12h