Critical Veeam Backup & Replication Flaw Allows Unauthenticated Attackers to Bypass Authorization

Veeam has released security updates to address a critical authorization bypass vulnerability in Backup & Replication. This flaw, tracked as CVE-2026-108142, allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

The vulnerability has a CVSS v4.0 score of 9.1 and affects both Windows deployments and the Veeam Software Appliance.

The company disclosed this issue in a security advisory (KB4948) published on October 27, 2026. The advisory also outlines two medium-severity path traversal vulnerabilities and a high-severity local privilege escalation flaw that affects managed Veeam Agent for Linux installations.

Veeam Backup & Replication Flaw

CVE-2026-108142 impacts Veeam Backup & Replication versions 13.1.1.18 and earlier within the 13.1 branch, as well as version 13.0.2.29 and earlier in the 13.0 branch. The advisory says older product generations, such as version 12.x, are not affected.

This vulnerability is distinct from the other issues disclosed because it can be exploited without an authenticated account. While Veeam’s description specifies an authorization bypass, it does not explicitly indicate that the issue allows for remote code execution, backup deletion, or total server compromise. The published release notes do not provide a detailed exploitation sequence or identify a specific affected service endpoint.

Veeam has designated Backup & Replication versions 13.1.2.57 and 13.0.3.63 as the fixed builds for this authorization bypass vulnerability. Administrators should note the branch-specific remediation requirements and not assume every version 13 deployment requires the same upgrade package.

The updates also address CVE-2026-108140 and CVE-2026-108141, both rated medium severity with a CVSS v4.0 score of 5.9.

These vulnerabilities require an authenticated user with the Restore Operator role who can control the contents of a backed-up network-attached storage share. Under these conditions, relative path traversal could allow an attacker to write controlled files to an arbitrary location on the backup server.

These prerequisites differentiate these flaws from the unauthenticated CDP issue. Veeam provides similar public descriptions for both vulnerabilities but does not clarify the differences in their underlying implementations. Both vulnerabilities receive fixes in the same Backup & Replication builds.

CVE-2026-105477 addresses a local privilege escalation issue in the Veeam Agent for Linux, rated high severity with a CVSS v4.0 score of 7.3. Only installations managed by Backup & Replication are affected.

The advisory specifies that Agent versions 13.1.1.4 and earlier in the 13.1 branch are vulnerable, while 13.0.x and 6.x versions are excluded. The fix is Agent version 13.1.2.11, which is included in Backup & Replication version 13.1.2.

For Windows deployments upgrading to version 13.1.2, Veeam requires the full deployment ISO or built-in updater; no standalone patch ISO or ZIP file is available due to changes in multiple third-party components. Appliance upgrades can be performed internally, and administrators should expect a possible reboot.

Administrators can verify the installed backup server version through the console’s Help > About menu before selecting the appropriate remediation path.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.