A user authenticated as an organization‑transfer peer can inject arbitrary SQL into the configuration database of a Veeam Backup for Microsoft 365 server. The injected statement allows the attacker to read from and modify data belonging to other tenants, and because the query runs under the PostgreSQL service account, the vulnerability enables remote code execution on the host machine. This is a classic SQL Injection flaw (CWE‑89).

All deployments of Veeam Backup for Microsoft 365 are affected. No specific version information is provided, so all installations should be considered vulnerable until a patch is applied.

The CVSS score of 9 indicates a high‑severity flaw. EPSS data are not available and the vulnerability is not listed in CISA KEV, but the lack of publicly developed exploits does not mitigate the risk. An attacker who has legitimate organization‑transfer peer privileges can trigger the flaw; no external network exposure is required beyond what that trusted role permits.