{"affected":[{"defaultStatus":"unaffected","product":"Backup for Microsoft 365","source":"CNA: hackerone","vendor":"Veeam","versions":[{"lessThanOrEqual":"8.6.0.1102","status":"affected","version":"8.0","versionType":"semver"}]}],"cveId":"CVE-2026-106078","cwes":["CWE-347"],"description":"A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.","epss":{"date":"2026-11-04","percentile":0.17962,"score":0.00261},"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: hackerone","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793815029773,"publishedAt":1793117818925,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://www.veeam.com/kb4957"}],"remediation":[],"revision":"b8d94c945cc0f976c19abd25163d82afe108eb614377c0fa2416234df2388b25","sources":[{"modifiedAt":1793815029773,"name":"CNA: hackerone","retrievedAt":1793815714391,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106078"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793815818256,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106078"}],"ssvc":{"assessedAt":1793815012558,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-106078","updatedAt":1793815818256}