Veeam patches critical Backup & Replication authorization bypass
Unauthenticated attackers can bypass CDP Coordinator checks; fixed builds are 13.1.2.57 and 13.0.3.63, with no exploitation reported.
74
Vulnerability1 · 1 read
CVE-2026-108140
Relative path traversal to arbitrary files on a backup server
- CVSS 4.0
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A relative path traversal flaw lets an authenticated Restore Operator who also controls the contents of a backed-up NAS share write attacker-controlled files to an arbitrary path on the backup server. The operator triggers this over the network with no user interaction by restoring that controlled share. Impact is high integrity and low availability on the backup server only.
What to do: No fixed version is stated. Apply the vendor update for CVE-2026-108140 when it is published.
Description · NVD
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
- Weakness
- CWE-22
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesVeeam patches critical unauthenticated authorization bypass in Backup & Replication
CVE-2026-108142 hits 13.0 and 13.1 branches; fixes are 13.0.3.63 and 13.1.2.57, and 12.x is unaffected.
68