Detections
Analytics

Veeam Management Pack for Microsoft System Center < 13.1.0.334 Multiple Vulnerabilities (kb4961)

critical Nessus Plugin ID 380225

Synopsis

The version of Veeam Management Pack for Microsoft System Center installed on the remote host is affected by multiple vulnerabilities.

Description

The version of Veeam Management Pack for Microsoft System Center installed on the remote host is prior to 13.1.0.334. It is, therefore, affected by multiple vulnerabilities as referenced in the kb4961 advisory.

 - An unauthenticated attacker can execute arbitrary code on servers running the Veeam Virtualization Extensions service. (CVE-2023-22793)

 - An authenticated attacker with membership in the Veeam Virtualization Extensions Users group can execute arbitrary code on servers running the Collector service. (CVE-2026-107239)

 - An authenticated domain user can execute arbitrary code as LocalSystem on servers running the Collector service. (CVE-2026-107238)

Note that version 9.x has no fix available; affected systems must upgrade to version 13.1.0.334.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Veeam Management Pack for Microsoft System Center version 13.1.0.334 or later.

See Also

https://www.veeam.com/kb4961

Plugin Details

Severity: Critical

ID: 380225

File Name: veeam_management_pack_kb4961.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 11/13/2026

Updated: 11/13/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.32

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-22793

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:veeam:management_pack

Required KB Items: SMB/Registry/Enumerated, installed_sw/Veeam Management Pack for Microsoft System Center

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2023-22793, CVE-2026-107238, CVE-2026-107239

IAVA: 2026-A-1231