Veeam has released security updates to correct a critical authorization bypass in Veeam Backup & Replication that could allow an attacker without credentials to circumvent access checks on the CDP Coordinator Service.
Tracked as CVE-2026-108142, the vulnerability has a CVSS v4.0 score of 9.1 and affects both Windows deployments and the Veeam Software Appliance.
The company published details on October 27, 2026 in security advisory KB4948. The advisory also covers two medium-severity file-write flaws in Backup & Replication and a high-severity local privilege escalation bug in Veeam Agent for Linux. All four issues were reported via HackerOne.
CVE-2026-108142 impacts Veeam Backup & Replication 13.1.1.18 and earlier builds in the 13.1 branch, and 13.0.2.29 and earlier builds in the 13.0 branch. Veeam states that 12.x releases are not affected.
The flaw is an authorization bypass — a weakness in the checks that determine what actions a caller may perform. Veeam says an unauthenticated attacker could bypass those checks on the CDP Coordinator Service.
The advisory does not describe the attack steps, does not indicate that the flaw enables remote code execution, and does not report any observed active exploitation.
Veeam Patches Backup & Replication Vulnerability
Veeam lists the first fixed builds as Backup & Replication 13.1.2 (build 13.1.2.57) and Backup & Replication 13.0.3 (build 13.0.3.63). Administrators should verify their installed build number rather than relying only on the major product version.
The update also remediates CVE-2026-108140 and CVE-2026-108141, each rated medium severity with a CVSS v4.0 score of 5.9. Both require an authenticated user assigned the Restore Operator role who can control the contents of a backed-up NAS share. Under those conditions, an attacker could use relative path traversal to write attacker-controlled files to arbitrary paths on the backup server, effectively escaping the intended directory.
The same Backup & Replication builds are listed as affected and fixed for those two vulnerabilities.
The separate Linux vulnerability, CVE-2026-105477, is rated high severity (CVSS v4.0 score 7.3) and permits local privilege escalation. It affects Veeam Agent for Linux installations that are managed by Backup & Replication; affected releases include 13.1.1.4 and earlier 13.1 builds. The fix is included beginning with version 13.1.2 (build 13.1.2.11).
Previous incidents have shown the risks to backup infrastructure: Cyber Security News reported attackers exploiting CVE-2024-40711 in Veeam to deploy the Frag ransomware. That separate incident does not indicate exploitation of this newly disclosed authorization bypass, but it underscores the potential impact of backup-targeted attacks.
The publication also noted Veeam’s October security update for version 12.3.2 and reminded users that different product branches may require distinct fixes.
Administrators can check their Backup & Replication build number via Help > About in the console. Veeam’s release information page contains update and deployment guidance.
Veeam warns that attackers often analyze published patches to find ways to compromise unpatched systems, so timely installation on affected backup servers and managed Linux agents is recommended.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.
