www.it-connect.fr
Critical Unauthenticated Flaw Hits Veeam Backup & Replication 13
Veeam Backup & Replication 13 is affected by CVE-2026-108142, a new critical security flaw in the CDP Coordinator service. What are the risks? How can you protect yourself? Here’s what you need to know.
On October 27, 2026, Veeam released a new security bulletin (KB4948) alongside the release of Veeam Backup & Replication 13.1.2. It references 4 vulnerabilities: 3 in Veeam Backup & Replication and 1 in Veeam Agent for Linux. And since the Veeam backup server is often a prime target, I thought it was important to tell you about it, especially because one of the vulnerabilities is critical.
CVE-2026-108142: CDP Coordinator service in the crosshairs
The most important flaw is associated with CVE-2026-108142. "A vulnerability allowing an unauthenticated attacker to bypass authorization.", Veeam notes in its bulletin. It is located in the Veeam CDP Coordinator service. As a reminder, this service runs on the backup server and coordinates replication and data transfer tasks for the CDP (Continuous Data Protection) feature.
This flaw, which has a CVSS v4.0 score of 9.1 out of 10, can be exploited remotely, without privileges and without user interaction. As Veeam explains, this issue does not allow direct remote code execution, but it does allow authorization bypass. An unauthenticated user could therefore access information they should not be able to see.
This vulnerability affects Windows deployments of Veeam Backup & Replication as well as the Veeam Software Appliance (Linux), in the following versions:
- 13.1 branch: Veeam Backup & Replication 13.1.1.18 and all earlier 13.1 builds.
- 13.0 branch: Veeam Backup & Replication 13.0.2.29 and all earlier 13.0 builds.
Veeam Backup & Replication version 12 is not affected.
Three other flaws, including one in the Linux agent
The three other vulnerabilities are less severe, but their exploitation conditions are interesting:
- CVE-2026-108140 and CVE-2026-108141 (CVSS score of 5.9): an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, can write files of their choice to an arbitrary location on the backup server via directory traversal. Both conditions must be met.
- CVE-2026-105477 (CVSS score of 7.3): a local privilege escalation in Veeam Agent for Linux. Only agents managed by a Veeam Backup & Replication instance are affected, in version 13.1.1.4 and earlier 13.1 builds. Versions 13.0.x and 6.x are not affected.
Which version should you install?
According to the Veeam Backup & Replication 13 release notes, the fixes are included in the following builds:
- Veeam Backup & Replication 13.1.2 (build 13.1.2.57): released on October 27, 2026.
- Veeam Backup & Replication 13.0.3 (build 13.0.3.63): this build dates back to August 25, 2026.
- Veeam Agent for Linux 13.1.2 (build 13.1.2.11): to fix CVE-2026-105477.
The security bulletin reports no active exploitation to date. However, Veeam reminds users that attackers analyze published patches to target unpatched servers.
