The monitoring server can become the way into the environment. Include it in the patch inventory.
New October 29, 2026 — Veeam KB4961. Veeam Management Pack for Microsoft System Center 13.1 fixes three remote-code-execution issues. Last verified: October 29, 2026. Check applicability in each environment; this advisory does not establish that every Veeam backup server is affected.
Affected scope and fixes
All three: Management Pack 9.1 and all earlier version 9 builds, including the Backup & Replication 13 compatibility patch. Veeam will not provide a 9.x fix. Unsupported versions were not tested; Veeam says they are likely affected and should be considered vulnerable.
| Issue | Required access / impact | Vendor rating |
|---|---|---|
| CVE-2023-22793 | Unauthenticated attacker; RCE on servers running the Veeam Virtualization Extensions service | Critical, CVSS 4.0 9.3 |
| CVE-2026-107238 | Authenticated domain user; RCE as LocalSystem on Collector-service servers | High, CVSS 4.0 8.7 |
| CVE-2026-107239 | Member of Veeam Virtualization Extensions Users group; RCE on Collector-service servers. Published vector includes attack prerequisites and passive user interaction. | High, CVSS 4.0 8.8 |
The fixed target for all three is 13.1 / build 13.1.0.334. KB4949 permits an in-place upgrade only from 9a / 9.1.0.3107; confirm this in the Operations Manager console under Administration → Management Packs. Get a vendor-supported path for earlier installations. Installation media is provided through Veeam My Account.
Exploitation and suggested priority
Veeam attributes these findings to internal testing. No active-exploitation claim was verified in the advisory. None of the three CVEs appears in the reviewed CISA KEV catalog; no KEV federal deadline applies. The older year in CVE-2023-22793 does not make this October 29 product advisory an old notification.
Suggested MSP priority: urgent applicability and exposure review; high-priority supported upgrade where affected. Unauthenticated RCE and a domain-user-to-LocalSystem path warrant attention even on internal management networks.
MSP action sequence
Inventory: identify Management Pack builds, Virtualization Extensions and Collector service hosts, allowed network paths and Veeam Virtualization Extensions Users membership.
Contain when warranted: restrict unnecessary service and management reachability to required trusted systems as a tested precaution. If suspicious execution or administration is found, preserve evidence and use the environment’s incident-response process. Access restrictions are not a verified complete workaround.
Patch: validate dependencies and recovery plans, follow KB4949’s supported upgrade route to 13.1.0.334, and obtain vendor guidance for older starting builds. Updating a B&R server alone does not establish that these Management Pack services were upgraded.
Verify: confirm the installed Management Pack build in Operations Manager and upgraded service hosts, then test Collector/Extensions connectivity, monitoring discovery, alerts and normal management functions.
KB4949 also lists .NET 10.0.13 among updated dependencies. That release-note entry does not establish closure of the separate October 25 .NET replacement fixes. Validate bundled-runtime support with Veeam; do not replace product components through an unverified upgrade procedure. No CVE-specific compromise-check or blanket credential-rotation requirement was verified in KB4961.
Official sources
Veeam KB4961 — vulnerability scope and fix matrix · KB4949 — build, upgrade prerequisite and download guidance · Veeam security advisory feed · CISA official KEV data