Veeam: Critical Flaw in Backup & Replication 13 — Authentication at the CDP Service Can Be Bypassed
On October 27, 2026, Veeam released updates for Backup & Replication, the Agent for Linux and Veeam ONE, fixing five vulnerabilities. The most serious, CVE-2026-108142, lets an attacker without credentials bypass authorization at the backup server's CDP Coordinator Service (CVSS 9.1). The 13.0 and 13.1 branches are affected. Anyone running them should schedule the updates promptly — backup servers are a preferred target for ransomware groups.
5
Vulnerabilities fixed
9.1
Highest CVSS v4 score
13.0 / 13.1
Affected branches
No indication
of exploitation (per media)
The Vulnerabilities at a Glance
Backup & Replication (Windows, Software Appliance)
Authorization bypass in the CDP Coordinator Service. An unauthenticated attacker can bypass the access check. The vector (AV:N, PR:N, UI:N) means: over the network, without credentials, without user interaction.
Backup & Replication (Windows, Software Appliance)
Relative path traversal: an authenticated user with the Restore Operator role who controls the content of a backed-up NAS share can write files to an arbitrary path on the backup server.
Backup & Replication (Windows, Software Appliance)
Same description and rating as CVE-2026-108140. Veeam does not state any difference between the two entries.
Veeam Agent for Linux (managed by Backup & Replication)
Local privilege escalation. Only installations managed by a Backup & Replication instance are affected. The vector (AV:L, PR:L) requires local access with low privileges.
Veeam ONE 13.1
MFA bypass: someone with valid administrator credentials can disable multi-factor authentication globally before the MFA check completes. The second factor therefore does not protect against stolen admin passwords.
All scores are CVSS v4.0 as published by Veeam. Veeam gives no CVSS v3 scores in its advisories.
Affected Versions and Fix Releases
Backup & Replication
Agent for Linux
Veeam ONE
According to Veeam, Backup & Replication 12.x is not affected. For Veeam ONE, 13.0.x and 12.x are not affected. For the Agent for Linux, the same goes for 13.0.x and 6.x. Fixes for Windows installations and the Software Appliance are listed under the same version number.
What Is Known — and What Is Not
- ▸On the attack path of CVE-2026-108142, Veeam only states that authorization at the CDP Coordinator Service can be bypassed. What an attacker can do afterwards is not in the advisory. heise assumes backup plans can be manipulated. None of the sources claims remote code execution.
- ▸Veeam does not name the affected network port or say whether the service is reachable from outside in the default configuration.
- ▸According to heise and Cyber Security News, active exploitation is not known. Veeam itself makes no statement on this. That is not an all-clear: Veeam itself points out that attackers reverse-engineer published patches.
- ▸According to the advisories there are no workarounds. The only measure is the update.
- ▸The flaws were reported through HackerOne. Veeam does not name the researchers.
Why Backup Servers Matter So Much
Whoever controls the backup server hits the last safety net: backup plans, retention and restore points. Ransomware groups therefore go there deliberately. Veeam flaws have been exploited before; Cyber Security News recalls CVE-2024-40711, which was used to spread Frag ransomware. There is no known connection to the new flaws. But the case shows that even for backup software, the window after a patch is published is critical.
Note on Veeam ONE
CVE-2026-107671 only affects Veeam ONE 13.1 and requires valid administrator credentials. The risk lies in a scenario after password theft: MFA no longer protects. Besides the update, a strong, unique admin password remains important.
What You Should Do Now
- ▸Check the version: read the exact build in the Veeam console under Help > About. The build number matters, not just the major version.
- ▸Update Backup & Replication to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). Bring managed Linux agents to 13.1.2 (build 13.1.2.11) and Veeam ONE to 13.1 P1 (build 13.1.0.7940).
- ▸Back up the configuration database before updating and plan the update using Veeam's upgrade notes (Veeam KB4738).
- ▸Our recommendation, not a Veeam workaround: make the backup server reachable only from the management network, not directly from the internet or user networks. This reduces the attack surface independently of this flaw.
- ▸Review roles: grant the Restore Operator role only to people who really need it. Backed-up NAS shares whose content third parties control are the starting point for the path traversal flaws.
- ▸Check logs and backup jobs for unexpected changes — such as new or changed backup plans, disabled jobs or shortened retention.
Need Support?
Terrion supports you with inventory, patch planning and securing your backup environment — get in touch.
Request Security Consultation →Sources: Veeam KB4948 · Veeam KB4951 · heise online · Cyber Security News