Veeam Backup & Replication · Disclosed

Veeam patches unauthenticated authorization bypass with CVSS 9.1

Oct 27, 2026 · 1 min read

Veeam has released fixes for five vulnerabilities in Backup & Replication, Veeam Agent for Linux and Veeam ONE. The most severe, CVE-2026-108142 (CVSS 9.1), lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service. No exploitation was reported in the source; update to the patched builds.

By HIFY Radar newsroom Updated 10/27/2026 09:15 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Veeam has released security updates for five flaws in Backup & Replication, Veeam Agent for Linux and Veeam ONE. The most severe lets an attacker without credentials bypass authorization on the CDP Coordinator Service, scored 9.1 out of 10. Others include local privilege escalation and an MFA bypass in Veeam ONE.

Why it matters

Backup & Replication holds the company's recovery copies. A flaw in this product can compromise the exact data used to restore operations after an incident. The most severe flaw requires no authentication, according to the source, so it needs immediate attention.

What to do

Update Backup & Replication to build 13.1.2.57 (version 13.1) or 13.0.3.63 (version 13.0), Veeam Agent for Linux to build 13.1.2.11, and Veeam ONE to build 13.1.0.7940 (13.1 P1).

For the technical team

CVE: CVE-2026-108142, CVE-2026-105477
Affected: Veeam Backup & Replication (CDP Coordinator Service), Veeam Agent for Linux e Veeam ONE · Backup & Replication 13.0 and 13.1 for the authorization and path traversal flaws; older 12.x releases are not affected by those specific issues. Veeam Agent for Linux (managed installations) and Veeam ONE also receive fixes.
Exploitation: Not reported in the source. No mention of public PoC, active exploitation or KEV listing.
Fix: Backup & Replication 13.1.2 build 13.1.2.57; Backup & Replication 13.0.3 build 13.0.3.63; Veeam Agent for Linux 13.1.2 build 13.1.2.11; Veeam ONE 13.1 P1 build 13.1.0.7940.
Vector: CVE-2026-108142 (CVSS 9.1): unauthenticated attacker bypasses authorization on the CDP Coordinator Service in Backup & Replication. CVE-2026-108140 and CVE-2026-108141 (CVSS 5.9): arbitrary file writes through path traversal. CVE-2026-105477 (CVSS 7.3): local privilege escalation in managed Veeam Agent for Linux installations. CVE-2026-107671 (CVSS 8.5): Veeam ONE administrator bypasses MFA by disabling it before completing verification.
More details: Five CVEs fixed in a single announcement. Disclosure and patch on October 28, 2026. Source: DarkWebInformer post on X about the Veeam updates.