Veeam Management Pack for Microsoft System Center 13.1

Vulnerability

Published 2026-10-29 New

Verified 2026-10-30

Veeam Management Pack for Microsoft System Center 13.1 (KB4961, 29 Oct) fixes three remote code execution flaws, one Critical and unauthenticated (CVE-2023-22793, CVSS 4.0 9.3); no fix for version 9.x

Veeam published KB4961, 'Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1', on 29 October 2026. It lists three vulnerabilities, all fixed starting in Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334). CVE-2023-22793 (Critical, CVSS v4.0 9.3) is "A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center."

CVE-2026-107238 (High, 8.7) allows "an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account" on servers running the Collector service, and CVE-2026-107239 (High, 8.8) allows "a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE)" on servers running the Collector service. Affected: Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch.

Veeam says: "A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334." Veeam lists all three as discovered during internal testing; KB4961 does not mention exploitation. (source: Veeam KB4961)

Product

Veeam Management Pack for Microsoft System Center (Virtualization Extensions service; Collector service)

Versions

Affected: 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch. Fixed: 13.1 (build 13.1.0.334). No fix for 9.x.

CVSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

AVAttack Vector: Network
ACAttack Complexity: Low
ATAttack Requirements: None
PRPrivileges Required: None
UIUser Interaction: None
VCVulnerable System Confidentiality: High
VIVulnerable System Integrity: High
VAVulnerable System Availability: High
SCSubsequent System Confidentiality: None
SISubsequent System Integrity: None
SASubsequent System Availability: None

(CVSS v4.0, Critical, Veeam) for CVE-2023-22793; 8.7 and 8.8 (High) for CVE-2026-107238 and CVE-2026-107239

Exploited in Australia?

unknown

Patch to

Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). Veeam will not fix version 9.x, so 9.x users must move to 13.1. Until then, limit network access to the servers running the Virtualization Extensions and Collector services, and review membership of the Veeam Virtualization Extensions Users group.

vulnerabilities