Veeam fixes a critical authorization bypass in Backup & Replication 13

Veeam fixes a critical authorization bypass in Backup & Replication 13

27 October 2026: Veeam has fixed CVE-2026-108142, a critical flaw (CVSS v4.0 9.1) that lets an attacker who is not logged in bypass authorization on the CDP Coordinator Service of Veeam Backup & Replication 13. It affects Windows-based installations and the Veeam Software Appliance, and is fixed in builds 13.1.2.57 and 13.0.3.63; Veeam's bulletin KB4948 says nothing about exploitation.

Not yet independently verified. Veeam's bulletin does not say whether the flaw has been exploited, and CISA had not listed it as exploited when we checked on 28 October. HKCERT's bulletin repeats Veeam's details; we have no independent technical analysis yet. We will update this when it can be confirmed, and remove this note.

The same bulletin fixes two medium-severity path-traversal flaws in Backup & Replication and a high-severity privilege escalation in Veeam Agent for Linux. The critical flaw was reported through HackerOne.

Which builds are affected and fixed

Backup & Replication version 12 and older are not affected by any of the server flaws. For version 13:

Product	Affected	Fixed in
Backup & Replication 13.1	13.1.1.18 and all earlier 13.1 builds	13.1.2 (build 13.1.2.57)
Backup & Replication 13.0	13.0.2.29 and all earlier 13.0 builds	13.0.3 (build 13.0.3.63)
Veeam Agent for Linux 13.1	13.1.1.4 and all earlier 13.1 builds	13.1.2 (build 13.1.2.11)

The agent flaw affects only Linux agents managed by a Backup & Replication server; agent versions 13.0.x and 6.x are not affected.

The two lower-rated flaws

CVE-2026-108140 and CVE-2026-108141 are each rated 5.9. They let an authenticated user who holds the Restore Operator role, and who also controls the contents of a backed-up NAS share, write files of their choosing to any path on the backup server through relative path traversal. The conditions are narrow, but a file written anywhere on a backup server is a short step from code execution, so they are worth fixing in the same window.

CVE-2026-105477, rated 7.3, is a local privilege escalation in Veeam Agent for Linux, which needs an attacker who already has a low-privileged account on the protected machine.

Why backup servers get patched first

Veeam's own bulletin is blunt about the risk: once a patch is public, attackers will likely try to reverse-engineer it, and it urges customers to install updates without delay. Backup servers matter more than most because they hold copies of everything and are the way back after a ransomware attack.

Administrators should check which build each Backup & Replication server and Software Appliance runs, upgrade to 13.1.2.57 or 13.0.3.63, and update managed Linux agents to 13.1.2.11. Where the CDP Coordinator Service is reachable from networks that do not need it, restricting access reduces exposure until the upgrade is done.

Our catalogue lists 4 products in backup software and 20 in server backup software.

Related on TrustList:

• Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes
• ConnectWise suspends Cloud Backup after attackers used its app identities
• Google Cloud Backup and DR deprecates the legacy appliance management console: new backups end 30 September 2027, restores 31 March 2028

Sources

• Veeam: KB4948, Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2, 27 October 2026
• HKCERT: Veeam Products Multiple Vulnerabilities, 28 October 2026