CVE Watch29 oct 2026

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running t

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 29 oct 2026 · Última mod.: 29 oct 2026 · CWE-502

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

Referencias oficiales

www.veeam.comhttps://www.veeam.com/kb4961

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2023-22793—

—

———A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.6h CVE-2026-621319.8 CRÍ

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.13h CVE-2026-620189.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.9h CVE-2026-620179.8 CRÍ

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.11h CVE-2026-620169.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.13h CVE-2026-620159.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.13h