Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability

Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service.

Tracked as CVE-2026-108142, the flaw carries a CVSS v4.0 score of 9.1 and affects both Windows-based deployments and the Veeam Software Appliance.

The company disclosed the issue on October 27, 2026, in its security advisory KB4948. The advisory also covers two medium-severity file-write vulnerabilities in Backup & Replication and a high-severity local privilege escalation flaw in Veeam Agent for Linux. HackerOne reported all four issues.

CVE-2026-108142 affects Veeam Backup & Replication 13.1.1.18 and earlier builds in the 13.1 branch, along with 13.0.2.29 and earlier builds in the 13.0 branch. Veeam identifies version 12.x as unaffected by this issue.

The flaw concerns authorization, the checks that decide which actions a caller can perform. Veeam says an unauthenticated attacker can bypass those checks on the CDP Coordinator Service.

However, the advisory does not describe the attack sequence or state that the vulnerability enables remote code execution. It also does not report active exploitation.

Veeam Patches Backup & Replication Vulnerability

Veeam lists the first fixed releases as Backup & Replication 13.1.2, build 13.1.2.57, and Backup & Replication 13.0.3, build 13.0.3.63. Administrators should match their installed version against these build numbers rather than checking only the main product version.

The update also addresses CVE-2026-108140 and CVE-2026-108141, each rated medium severity with a CVSS v4.0 score of 5.9. Both require an authenticated user with the Restore Operator role who also controls the contents of a backed-up network-attached storage (NAS) share.

Under those conditions, an attacker can use relative path traversal to write attacker-controlled files to an arbitrary path on the backup server. In simple terms, the file path can escape its intended folder. Veeam lists the same affected Backup & Replication builds and fixed releases for both vulnerabilities.

The separate Linux issue, CVE-2026-105477, has a high-severity score of 7.3. It allows local privilege escalation and affects only Veeam Agent for Linux installations managed by Backup & Replication. Affected releases include 13.1.1.4 and earlier 13.1 builds. The fix starts with version 13.1.2, build 13.1.2.11.

Cyber Security News previously reported attackers exploiting CVE-2024-40711 in Veeam to deploy Frag ransomware, highlighting backup security risks, though this separate vulnerability does not confirm exploitation of the newly disclosed authorization bypass.

The publication also reported Veeam’s October security update for version 12.3.2, noting that different product branches may require different patches.

Administrators can check their installed Backup & Replication build through Help > About in the console. Veeam’s release information page provides update guidance.

The company warns that attackers may study released patches to find ways into unpatched systems, making timely installation important across affected backup servers and managed Linux agents.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability appeared first on Cyber Security News.