Veeam patches critical Backup & Replication authorization bypass
First merged summary.
Veeam fixed a critical unauthenticated authorization bypass in Backup & Replication 13.0 and 13.1; no exploitation is reported.
Veeam advisory KB4948, disclosed October 27, 2026, fixes CVE-2026-108142, a CVSS 9.1 unauthenticated authorization bypass in the CDP Coordinator Service on Windows deployments and the Veeam Software Appliance. Builds through 13.1.1.18 and 13.0.2.29 are affected; 12.x is not. Fixed builds are 13.1.2.57 and 13.0.3.63. The same releases address two medium path-traversal flaws and a high local privilege escalation in managed Agent for Linux, all reported by HackerOne. Veeam does not report exploitation. Canada’s cyber centre lists further cutoffs for Backup for Microsoft 365 and Veeam ONE, and SecurityWeek says Veeam issued nine fixes, including a critical cross-tenant flaw in Backup for Microsoft 365.
- CVE-2026-108142 scores 9.1; fixes are builds 13.1.2.57 and 13.0.3.63.
- CVE-2026-108140 and CVE-2026-108141 score 5.9 and require a Restore Operator.
- CVE-2026-105477 scores 7.3; Agent for Linux is fixed in 13.1.2.11.
- Canadian centre: Microsoft 365 backup affected at or before 8.5.0.1014 and 8.6.0.1102.
- Veeam ONE is affected at or before 13.1.0.7233, according to the Canadian centre.
- SecurityWeek says Veeam reports no in-the-wild exploitation.
Timeline
dated events in the reporting · oldest first- Oct 27, 2026Veeam discloses KB4948 for the authorization bypass. · Cyber Security News
- Oct 28, 2026Canadian centre publishes Veeam alert AV26-1096. · Canadian Centre for Cyber Security
- Oct 29, 2026SecurityWeek reports nine Veeam fixes and no exploitation. · SecurityWeek
What each outlet adds
beyond the shared facts- GBHackersExact affected builds and that Agent 13.0.x and 6.x are excluded.
- Cyber Security NewsHackerOne reported all four issues; check Help > About.
- Canadian Centre for Cyber SecurityMicrosoft 365 and Veeam ONE version cutoffs, without CVE ids.
- SecurityWeekNine Veeam fixes, including cross-tenant Microsoft 365 code execution.
- Vendors
- VeeamAdobeJuniper Networks
- Products
- Veeam Backup & ReplicationVeeam Agent for LinuxVeeam Software ApplianceBackup & ReplicationAgent for LinuxCampaign ClassicAdobe ConnectCreative CloudSubstance 3D PainterBackup for Microsoft 365Veeam ONESession Smart Router
- Organizations
- HackerOneCanadian Centre for Cyber Security
Coverage
oldest first · one row per article · UTC- · 2d ago
GBHackersFirst report
Veeam patches critical unauthenticated authorization bypass in Backup & Replication
CVE-2026-108142 hits 13.0 and 13.1 branches; fixes are 13.0.3.63 and 13.1.2.57, and 12.x is unaffected.
- · 2d ago
Cyber Security News
Veeam patches critical Backup & Replication authorization bypass
Unauthenticated attackers can bypass CDP Coordinator checks; fixed builds are 13.1.2.57 and 13.0.3.63, with no exploitation reported.
- · 2d ago
Canadian Centre for Cyber Security
Veeam backup products affected by vulnerabilities ahead of fixes
The Canadian Cyber Centre lists affected builds of Agent for Linux, Backup and Replication, Backup for Microsoft 365 and Veeam ONE.
- · 1d ago
SecurityWeek
Adobe, Veeam and Juniper patch critical code-execution flaws
None of the vendors reports exploitation; fixes cover cross-tenant code execution in Veeam and unauthenticated command execution in Session Smart.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105477 | Local privilege escalation in managed Veeam Agent for Linux | 7.3 | — | ||
| CVE-2026-108140 | Relative path traversal to arbitrary files on a backup server | 5.9 | — | ||
| CVE-2026-108141 | Relative path traversal file write via Restore Operator | 5.9 | — | ||
| CVE-2026-108142 | Unauthenticated authorization bypass in CDP Coordinator Service | 9.1 | — | ||
| CVE-2026-109618 | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |