Veeam Backup Replication CVE-2026-108142 Patch Explained: Critical 9.1 Authorization Bypass, Fixed Versions and What to Update
Illustrative image: server racks in a data centre — the kind of infrastructure backup software protects, not a Veeam product screenshot. Image: Wikimedia Commons / NERSC, CC0.
TL;DR — Veeam Backup Replication CVE-2026-108142 patch explained in one line: Veeam's 27 October 2026 security update fixes a critical 9.1-rated flaw that lets an attacker without any login bypass authorization checks on the backup server's CDP Coordinator Service — update to Backup & Replication 13.1.2 or 13.0.3 now, because no workaround exists and version 12.x is not affected.
📌 KEY HIGHLIGHTS
- CVE-2026-108142 is a critical authorization bypass (CVSS v4.0 score 9.1) in Veeam Backup & Replication's CDP Coordinator Service — no login or credentials needed.
- Affected: Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, on Windows and the Veeam Software Appliance.
- Fixed in Backup & Replication 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63). Version 12.x is not affected.
- The same 27 October advisory (KB4948) also fixes two medium path-traversal flaws and a high-severity privilege-escalation bug in managed Veeam Agent for Linux.
- No active exploitation has been confirmed and no public exploit code has been reported — but Veeam warns attackers reverse-engineer patches quickly, so the quiet window is the time to update.
What happened?
Veeam published security advisory KB4948 on 27 October 2026, disclosing four vulnerabilities in its backup products, all reported through HackerOne. The headline flaw is CVE-2026-108142: an unauthenticated attacker with network access to the backup server can bypass the authorization checks performed by the Continuous Data Protection (CDP) Coordinator Service — the component that coordinates replication and data-transfer work for continuous data protection.
Authorization is the gatekeeper that decides which actions a caller is allowed to perform. Bypassing it without any credentials is what pushes this flaw to a critical 9.1 CVSS v4.0 score, with high integrity and availability impact on the backup system and on subsequent systems. Both Windows-based Backup & Replication deployments and the Veeam Software Appliance are affected.
Two honesty notes matter here. First, Veeam does not describe the attack sequence, and it does not state that this flaw enables remote code execution, backup deletion, or full server compromise — so this post does not claim those either. Second, no active exploitation and no public proof-of-concept have been reported so far. That is good news, not a reason to wait: Veeam itself notes that once a patch is public, attackers try to reverse-engineer it to hit unpatched systems.
Veeam Backup Replication CVE-2026-108142 patch explained: affected and fixed versions
Check your build number first — the fix depends on which version 13 branch you run:
| Branch | Affected builds | Fixed build |
|---|---|---|
| Backup & Replication 13.1 | 13.1.1.18 and all earlier 13.1 builds | 13.1.2 (build 13.1.2.57) |
| Backup & Replication 13.0 | 13.0.2.29 and all earlier 13.0 builds | 13.0.3 (build 13.0.3.63) |
| Backup & Replication 12.x | Not affected | — |
Do not assume one patch covers every version 13 deployment: a 13.0 system needs the 13.0.3 update and a 13.1 system needs 13.1.2. There is no workaround listed in the advisory, so patching is the fix — and while you are at it, confirm the backup server is not reachable from the public internet, since network access is the precondition for this flaw.
Illustrative image: CERN server room — the kind of infrastructure backup software protects, not a Veeam installation. Image: Wikimedia Commons / CERN.
What else the 27 October update fixes
KB4948 is a bundle, not a single fix. The other flaws in the same release:
| Flaw | Severity (CVSS v4.0) | Who it affects |
|---|---|---|
| CVE-2026-108140 — relative path traversal | Medium (5.9) | Authenticated user with the Restore Operator role who also controls a backed-up NAS share; can write attacker-controlled files to an arbitrary path on the backup server |
| CVE-2026-108141 — relative path traversal | Medium (5.9) | Same conditions as CVE-2026-108140; Veeam gives the two flaws identical public descriptions |
| CVE-2026-105477 — Veeam Agent for Linux privilege escalation | High (7.3) | Only Linux agent installations managed by a Backup & Replication instance; fixed in Agent for Linux 13.1.2 (build 13.1.2.11). Agent 13.0.x and 6.x are not affected |
| CVE-2026-107671 — Veeam ONE authentication bypass | High (per release coverage) | Veeam ONE; fixed in Veeam ONE 13.1 P1, per coverage of the release |
The two medium path-traversal flaws need an authenticated Restore Operator account plus control of a backed-up NAS share, so they are far narrower than the unauthenticated CDP bypass — but they are fixed by the same Backup & Replication updates, so one patch run closes all of them. Reviewing who holds Restore Operator rights is a sensible step alongside the update.
Why it matters for India readers
Backup servers are among the most valuable targets in any network, and India is no exception: businesses, hospitals, schools and the managed service providers (MSPs) that run IT for smaller firms all rely on backup platforms like Veeam to recover from ransomware and outages. Attackers target backup infrastructure precisely because destroying or corrupting recovery data makes a ransom much harder to refuse.
For Indian teams, the practical message is the same as everywhere else: this is a patch-first, no-workaround disclosure on a system that should never be internet-facing in the first place. If an MSP manages your backups, confirm it has applied the 13.1.2 or 13.0.3 update rather than assuming it. And use the patch window to test a restore — a backup you have never restored is a hope, not a recovery plan. For context on how fast exploited flaws escalate, see the Magento PolyShell flaw that reached CISA's exploited list after hitting 953 stores. Recent breach coverage shows the victim side of the same story: the Sony So-Net breach affecting 2.58 million people and the Belgium tax portal cyberattack that shut online services.
Should you care? ✅ / ⏳
Verdict: ✅ Patch this week if you run version 13 — do not wait for a routine maintenance window. The flaw needs no login, affects the backup server itself, and has no workaround. If you run version 12.x, you are not affected by this flaw, but the same discipline applies to the next advisory. Everyone else: update, restrict backup-server access to trusted admin systems only, and verify a restore works.
FAQs
What is CVE-2026-108142? CVE-2026-108142 is a critical authorization-bypass vulnerability (CVSS v4.0 score 9.1) in Veeam Backup & Replication's CDP Coordinator Service. It lets an unauthenticated attacker with network access bypass authorization checks on the backup server. Veeam disclosed it on 27 October 2026 in advisory KB4948.
Which Veeam versions are affected by CVE-2026-108142? Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, on both Windows deployments and the Veeam Software Appliance. Version 12.x is not affected.
How do I patch CVE-2026-108142? Update to Backup & Replication 13.1.2 (build 13.1.2.57) if you run the 13.1 branch, or 13.0.3 (build 13.0.3.63) if you run the 13.0 branch. There is no workaround, so patching is the fix; also keep the backup server off the public internet and restrict access to trusted admin systems.
Is CVE-2026-108142 being exploited? No active exploitation has been confirmed and no public proof-of-concept has been reported. Veeam warns, however, that attackers reverse-engineer patches to target unpatched deployments, so the absence of exploitation reports today is not a reason to delay.
Does CVE-2026-108142 let attackers run code on the backup server? Veeam has not said so. The advisory describes an authorization bypass with high integrity and availability impact; it does not describe an attack sequence or claim remote code execution. Treat the confirmed risk — unauthenticated bypass of authorization on the backup server — as serious enough on its own.
Takeaway: A no-login flaw in the system that holds your last line of defence is exactly the kind of patch that should jump the queue — update Veeam Backup & Replication to 13.1.2 or 13.0.3, lock the backup server off the internet, and test a restore.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- Veeam KB4948 — Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 (27 Oct 2026)
- GBHackers — Critical Veeam Backup & Replication Flaw Allows Unauthenticated Attackers to Bypass Authorization (28 Oct 2026)
- Cyber Press — Veeam Patches Critical Backup & Replication Flaw Allowing Unauthenticated Authorization Bypass (28 Oct 2026)
- Cryptika — Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability (28 Oct 2026)
Comments
Post a Comment