Veeam Backup & Replication 13: Critical CVE-2026-108142 Vulnerability Allows Unauthenticated Attacks

Veeam has released security updates for a critical vulnerability in Veeam Backup & Replication 13. Tracked as CVE-2026-108142, the flaw allows remote attackers to bypass authorization checks on the CDP Coordinator Service without an account or password. With a CVSS v4.0 score of 9.1, the vulnerability puts the integrity and availability of affected backup infrastructure at risk. Veeam Software+1

Summary

Administrators running Veeam Backup & Replication 13.1 or 13.0 should check their installed build and upgrade to a fixed release: version 13.1.2 (build 13.1.2.57) or version 13.0.3 (build 13.0.3.63). Veeam’s advisory identifies these releases as fixes for CVE-2026-108142. Veeam Software+1

Table of Contents

• What is CVE-2026-108142?
• Which versions are affected?
• What are the security risks?
• How to fix the vulnerability
• Other vulnerabilities addressed
• Frequently Asked Questions

What Is CVE-2026-108142?

Published in Veeam’s security advisory KB4948 on October 27, 2026, CVE-2026-108142 affects the CDP Coordinator Service in Veeam Backup & Replication.

CDP stands for Continuous Data Protection, a technology designed to reduce data loss by continuously capturing changes to protected workloads. The vulnerability lies in the service’s authorization controls, which determine whether a request should be permitted.

According to Veeam, an unauthenticated attacker can bypass these checks remotely. The flaw has a CVSS v4.0 score of 9.1, placing it in the critical severity category. Veeam Software+1

Why Is the Vulnerability Dangerous?

Backup infrastructure is a high-value target because it helps organizations recover from ransomware, system failures and data loss.

An attacker who compromises the integrity or availability of backup infrastructure could undermine an organization’s recovery capabilities. However, the published advisory does not establish that CVE-2026-108142 automatically enables remote code execution or gives an attacker unrestricted control of the entire server.

Security teams should therefore treat the vulnerability as urgent without assuming that every possible attack outcome has been demonstrated.

Which Versions of Veeam Backup & Replication Are Affected?

Veeam’s official security advisory identifies the following affected releases. Veeam Software

Product branch	Vulnerable versions	Fixed version
13.1	13.1.1.18 and earlier 13.1 builds	13.1.2, build 13.1.2.57
13.0	13.0.2.29 and earlier 13.0 builds	13.0.3, build 13.0.3.63
12.x	Not affected by this CVE	No upgrade required specifically for this CVE

Both Windows-based installations and the Veeam Software Appliance are affected. Administrators should check the exact build number rather than relying on the major version alone. Veeam Software+1

What Are the Security Risks?

The primary concern is unauthorized access to functionality protected by the CDP Coordinator Service.

The potential consequences include:

• Backup infrastructure disruption: Unauthorized operations could affect the availability of critical services.
• Data integrity risks: The vulnerability can affect integrity, potentially interfering with normal operations.
• Increased recovery risk: If an attacker disrupts backup infrastructure, recovering from a separate ransomware incident or system failure could become more difficult.
• Exposure of unpatched systems: Attackers may analyze public patches to develop exploits against systems that have not been updated. Veeam explicitly warns about this risk. Veeam Software+1

As of the published CERT Santé advisory, no active exploitation or public proof of concept had been reported. This status can change, so administrators should consult current advisories rather than assume the vulnerability remains unexploited. Portail du CERT Santé

How to Fix CVE-2026-108142

1. Check your installed version

Open the Veeam Backup & Replication console and select Help → About. Record the full product version and build number.

2. Install the appropriate security update

Upgrade to build 13.1.2.57 or later in the 13.1 branch, or build 13.0.3.63 or later in the 13.0 branch. Obtain the installer or update through Veeam’s official release information. Veeam Software+1

3. Restrict network exposure

Limit access to backup servers to trusted administrative networks. Use firewalls and network segmentation to prevent unnecessary connections to backup infrastructure. These measures reduce exposure but do not replace the security update.

4. Verify the update and review logs

Confirm that the fixed build is installed, check backup job health, and investigate unusual access attempts or unexpected service activity. If you suspect compromise, follow your incident response process and preserve relevant logs.

Other Vulnerabilities Addressed in the Same Update

Veeam’s October 27 security advisory also documents three additional vulnerabilities. Veeam Software

CVE	Severity	Description
CVE-2026-108140	Medium — 5.9	Path traversal that can allow unauthorized file writes under specific conditions
CVE-2026-108141	Medium — 5.9	A second path traversal vulnerability with similar prerequisites
CVE-2026-105477	High — 7.3	Local privilege escalation in certain managed Veeam Agent for Linux installations

The first two flaws require an authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share. The Linux vulnerability affects Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds when managed by Veeam Backup & Replication. Its fix starts with Agent build 13.1.2.11. Veeam Software

Administrators should review the complete advisory and address every vulnerability that applies to their deployment, rather than focusing exclusively on CVE-2026-108142.

Frequently Asked Questions

Can CVE-2026-108142 be exploited without a password?

Yes. Veeam confirms that the vulnerability allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. Veeam Software

Is Veeam Backup & Replication 12 affected?

No. Veeam explicitly excludes older 12.x versions from this vulnerability. This exclusion applies to CVE-2026-108142 and does not establish that version 12 is free of other security issues. Veeam Software

Does the vulnerability allow remote code execution?

Veeam’s published advisory describes an authorization bypass. It does not confirm that this CVE provides remote code execution, so administrators should not treat RCE as an established consequence.

What is the CVSS score?

The official Veeam advisory assigns CVE-2026-108142 a CVSS v4.0 score of 9.1, classified as critical. Veeam Software

What should administrators do first?

Identify every Veeam Backup & Replication 13 deployment, verify its build number, and prioritize upgrading affected systems to the appropriate fixed release. Restrict network access while arranging the update.

Conclusion

CVE-2026-108142 highlights the importance of securing backup infrastructure as carefully as production servers. Its critical severity, remote attack vector and lack of authentication requirements make prompt remediation essential for organizations running affected Veeam Backup & Replication 13 builds.

The recommended action is clear: verify your version, install the appropriate fixed build, restrict unnecessary network access and review the remaining vulnerabilities covered by Veeam’s advisory.