Veeam patches critical unauthenticated authorization bypass in Backup & Replication
Original title: Critical Veeam Backup & Replication Flaw Allows Unauthenticated Attackers to Bypass Authorization
CVE-2026-108142 hits 13.0 and 13.1 branches; fixes are 13.0.3.63 and 13.1.2.57, and 12.x is unaffected.
Veeam’s October 27 advisory KB4948 fixes CVE-2026-108142, a CVSS 9.1 authorization bypass that lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service in Windows deployments and the Veeam Software Appliance. Versions 13.1.1.18 and earlier in the 13.1 branch and 13.0.2.29 and earlier in 13.0 are affected; 12.x is not. The same builds also fix two medium path-traversal bugs, and Agent for Linux 13.1.2.11 fixes a high local privilege escalation.
Unconfirmed: Veeam does not say whether the bypass enables code execution, backup deletion, or full server compromise.
- Fixed Backup & Replication builds are 13.1.2.57 and 13.0.3.63.
- CVE-2026-108140 and CVE-2026-108141 score 5.9 and need a Restore Operator on NAS contents.
- CVE-2026-105477 scores 7.3 and affects managed Agent for Linux 13.1.1.4 and earlier, not 13.0.x or 6.x.
- Windows upgrades to 13.1.2 need the full ISO or built-in updater; appliances may reboot.
Impact: Unauthenticated authorization bypass on the CDP Coordinator Service
| Product | Affected | Fixed in |
|---|---|---|
| Veeam Backup & Replication | 13.1.1.18 and earlier in 13.1; 13.0.2.29 and earlier in 13.0 | 13.1.2.57 and 13.0.3.63 |
| Veeam Agent for Linux | 13.1.1.4 and earlier in the 13.1 branch, when managed by Backup & Replication | 13.1.2.11 |
- 1.Upgrade the matching branch to Backup & Replication 13.1.2.57 or 13.0.3.63.
- 2.For Windows 13.1.2, use the full deployment ISO or built-in updater.
- 3.Check the installed version in the console Help > About menu before upgrading.
- Vendors
- Veeam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105477 | Local privilege escalation in managed Veeam Agent for Linux | 7.3 | — | ||
| CVE-2026-108140 | Relative path traversal to arbitrary files on a backup server | 5.9 | — | ||
| CVE-2026-108141 | Relative path traversal file write via Restore Operator | 5.9 | — | ||
| CVE-2026-108142 | Unauthenticated authorization bypass in CDP Coordinator Service | 9.1 | — |
From the original article
2 min read at gbhackers.com
Veeam has released security updates to address a critical authorization bypass vulnerability in Backup & Replication. This flaw, tracked as CVE-2026-108142, allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. The vulnerability has a CVSS v4.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.