Veeam patches critical Backup & Replication authorization bypass
Original title: Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability
Unauthenticated attackers can bypass CDP Coordinator checks; fixed builds are 13.1.2.57 and 13.0.3.63, with no exploitation reported.
Veeam advisory KB4948, disclosed October 27, 2026, fixes CVE-2026-108142, a CVSS 9.1 authorization bypass in the CDP Coordinator Service on Windows deployments and the Veeam Software Appliance. Builds through 13.1.1.18 and 13.0.2.29 are affected; version 12.x is not. The update also covers two medium file-write flaws and a high-severity local privilege escalation in managed Veeam Agent for Linux. HackerOne reported all four issues, and Veeam does not report active exploitation.
Unconfirmed: The advisory does not describe the attack sequence or say the bypass enables remote code execution.
- Fixed Backup & Replication releases are 13.1.2 build 13.1.2.57 and 13.0.3 build 13.0.3.63.
- CVE-2026-108140 and CVE-2026-108141 score 5.9 and need a Restore Operator plus NAS control.
- CVE-2026-105477 scores 7.3; Agent for Linux is fixed in 13.1.2 build 13.1.2.11.
- Administrators should compare the installed build via Help > About.
Impact: Unauthenticated bypass of CDP Coordinator Service access checks
| Product | Affected | Fixed in |
|---|---|---|
| Veeam Backup & Replication | 13.1.1.18 and earlier 13.1 builds; 13.0.2.29 and earlier 13.0 builds | 13.1.2 build 13.1.2.57; 13.0.3 build 13.0.3.63 |
| Veeam Agent for Linux | 13.1.1.4 and earlier 13.1 builds, when managed by Backup & Replication | 13.1.2 build 13.1.2.11 |
- 1.Update Backup & Replication to 13.1.2 build 13.1.2.57 or 13.0.3 build 13.0.3.63.
- 2.Update managed Veeam Agent for Linux to 13.1.2 build 13.1.2.11.
- 3.Confirm the installed build in Help > About rather than the major version alone.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105477 | Local privilege escalation in managed Veeam Agent for Linux | 7.3 | — | ||
| CVE-2026-108140 | Relative path traversal to arbitrary files on a backup server | 5.9 | — | ||
| CVE-2026-108141 | Relative path traversal file write via Restore Operator | 5.9 | — | ||
| CVE-2026-108142 | Unauthenticated authorization bypass in CDP Coordinator Service | 9.1 | — |
From the original article
2 min read at cybersecuritynews.com
Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service. Tracked as CVE-2026-108142, the flaw carries a CVSS v4. 0 score of 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.