CVE-2026-108142: Critical Veeam Backup & Replication Authorization Bypass

Veeam has released security updates to address CVE-2026-108142, a critical authorization bypass vulnerability affecting Veeam Backup & Replication 13. The flaw allows an unauthenticated remote attacker to bypass authorization controls associated with the Veeam CDP Coordinator Service.

The vulnerability carries a CVSS v4.0 score of 9.1 and affects both Windows-based Veeam Backup & Replication deployments and the Veeam Software Appliance. Veeam disclosed the issue on October 27, 2026 as part of security advisory KB4948.

Backup infrastructure is an especially sensitive security target because it contains recovery data and often has privileged connectivity to production systems. An authorization weakness affecting a central backup component therefore warrants immediate attention even though the vendor has not publicly documented the complete exploitation chain.

Veeam’s CVSS vector identifies network-based exploitation with low attack complexity, no privileges required, and no user interaction. However, the vector also specifies that additional attack requirements must be present. Veeam has not publicly explained those prerequisites.

The vulnerability affects Veeam Backup & Replication 13.1.1.18 and all earlier builds in the 13.1 branch, as well as version 13.0.2.29 and all earlier 13.0 builds. Veeam explicitly states that older releases such as version 12.x are not affected by this specific flaw.

For CVE-2026-108142 detection, security teams should prioritize identifying vulnerable Backup & Replication installations and monitoring the backup server for unexpected activity involving the CDP Coordinator Service, unauthorized configuration changes, suspicious backup infrastructure modifications, and network connections from untrusted systems.

SOC Prime users can strengthen visibility into vulnerability exploitation and post-compromise activity by correlating network, endpoint, identity, and application telemetry with behavior-based detection content.

Click Explore Detections to access relevant detection content and hunting logic. To Detect CVE-2026-108142, defenders should combine vulnerability inventory with monitoring of Veeam services, administrative activity, system changes, and network access to backup infrastructure.

Contact Sales

CVE-2026-108142 analysis

The vulnerability is located in the Veeam CDP Coordinator Service, a component of Veeam Backup & Replication responsible for coordinating Continuous Data Protection operations.

According to Veeam documentation, the CDP Coordinator Service runs on the backup server and communicates with VMware vCenter, assigns CDP tasks, manages infrastructure components involved in Continuous Data Protection, and coordinates replication and data transfer operations.

This makes authorization controls around the service particularly important. The backup server acts as the configuration and management core of the backup infrastructure, while the CDP Coordinator Service can interact with infrastructure components involved in replication.

The details for CVE-2026-108142 remain intentionally limited in the public disclosure.

Veeam describes the vulnerability as allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service but does not disclose the vulnerable request, affected function, protocol interaction, exploitation sequence, or underlying implementation defect.

The CVE is categorized as CWE-636, Not Failing Securely, commonly described as a “fail-open” condition. This weakness class occurs when a security mechanism encounters an error or unexpected state and falls into a less secure condition instead of denying access.

However, the CWE classification alone should not be used to infer the precise implementation error in Veeam’s software. The vendor has not published enough technical information to determine exactly how the authorization bypass is triggered.

The CVSS v4.0 vector is:

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

This indicates:

• Network-based attack vector
• Low attack complexity
• Additional attack requirements present
• No privileges required
• No user interaction required
• No direct confidentiality impact identified
• High integrity and availability impact
• High integrity and availability impact on subsequent systems

That final distinction is important. Veeam’s scoring suggests that successful exploitation could affect not only the vulnerable backup system but also systems downstream from it. However, the vendor has not described exactly what operations an attacker can perform after bypassing authorization.

Neither Veeam nor the supplied reports state that the vulnerability provides arbitrary remote code execution.

CybersecurityNews specifically notes that the advisory does not describe an attack sequence or say that the flaw enables RCE. CyberPress likewise states that Veeam has not published exploitation steps or claimed code execution.

Therefore, claims that the flaw directly provides shell access, SYSTEM privileges, credential theft, or arbitrary command execution would currently go beyond the available evidence.

CVE-2026-108142 affects two Veeam Backup & Replication 13 branches:

• Version 13.1.1.18 and earlier 13.1 builds
• Version 13.0.2.29 and earlier 13.0 builds

The vulnerability applies to both Windows-based Veeam Backup & Replication installations and Veeam Software Appliance deployments.

Veeam Backup & Replication 12.x and other older releases identified by the vendor are not affected by this particular issue.

Organizations should verify the exact build rather than relying solely on the major version number.

For example, an installation reporting version 13.1 may still be vulnerable unless it has been upgraded to build 13.1.2.57 or later.

Administrators can review their installed Backup & Replication build from the product interface and compare it with Veeam’s release information.

At the time of writing, no public CVE-2026-108142 PoC has been documented by Veeam or the supplied security reports. Independent public vulnerability tracking also reports no openly available proof-of-concept exploit.

Veeam has likewise not reported active exploitation of the vulnerability.

This distinction is particularly relevant because Veeam infrastructure has been targeted through other vulnerabilities in previous attacks. CybersecurityNews notes prior exploitation of CVE-2024-40711 in ransomware operations, but that historical activity does not demonstrate exploitation of the newly disclosed authorization bypass.

As of October 29, 2026, the new CVE is also not listed in CISA’s Known Exploited Vulnerabilities catalog according to currently available vulnerability tracking data.

There are therefore no confirmed campaign-specific CVE-2026-108142 IOCs such as malicious IP addresses, domains, hashes, exploit payloads, or known attacker infrastructure associated with this vulnerability.

Security teams should instead focus on exposure assessment and behavioral monitoring.

Potential investigation points include:

• Network connections to Veeam backup infrastructure from unexpected systems
• Unexpected interaction with the CDP Coordinator Service
• Unauthorized changes to backup or CDP configuration
• New or modified backup jobs without an administrative explanation
• Unexpected service restarts or failures
• Changes to replication policies
• Modifications to protected infrastructure that do not correspond with approved administrative activity
• Suspicious account or privilege changes on the backup server
• Unexpected processes or network activity originating from Veeam infrastructure
• Attempts to reach backup management services from user networks or internet-facing systems

These behaviors are not vulnerability-specific indicators. They are defensive hunting opportunities that may help uncover suspicious activity involving a critical backup server while technical exploitation details remain unavailable.

Organizations should also review network segmentation around Veeam infrastructure.

Backup servers should not be broadly reachable from ordinary workstations, guest environments, or untrusted network segments. Only systems that require communication with Veeam services should be permitted to reach the relevant interfaces and ports.

This reduces the number of systems capable of interacting with a vulnerable service while patches are being deployed.

The October security update also addresses three additional vulnerabilities.

CVE-2026-108140 and CVE-2026-108141 are medium-severity relative path traversal vulnerabilities rated CVSS 5.9. Exploitation requires an authenticated Restore Operator who also controls the contents of a backed-up NAS share. Under those conditions, attacker-controlled files can be written to arbitrary locations on the backup server.

A separate issue, CVE-2026-105477, affects Veeam Agent for Linux installations managed by Backup & Replication. The high-severity vulnerability can enable local privilege escalation and is fixed in Veeam Agent for Linux 13.1.2, build 13.1.2.11.

Organizations applying the October updates should therefore review their entire Veeam environment rather than addressing only the critical authorization bypass.

CVE-2026-108142 Mitigation

The primary remediation is to install the fixed Veeam Backup & Replication releases.

For the 13.1 branch, upgrade to:

Veeam Backup & Replication 13.1.2 — build 13.1.2.57

For the 13.0 branch, upgrade to:

Veeam Backup & Replication 13.0.3 — build 13.0.3.63

These builds contain the vendor-provided fix for the authorization vulnerability.

The recommended CVE-2026-108142 mitigation process should begin with identifying every Veeam Backup & Replication server and determining its exact installed build.

Security teams should prioritize upgrades for backup servers that are accessible across large network segments, connected to critical virtualization infrastructure, or supporting high-value production workloads.

The patch should be treated as a security priority because exploitation requires no authenticated account according to the published CVSS vector.

Veeam has not published a complete workaround in KB4948 that eliminates the vulnerability without installing the fixed software.

If an immediate upgrade is operationally impossible, organizations should apply defense-in-depth measures until patching can be completed:

• Restrict access to Veeam backup servers using network segmentation.
• Permit connections only from systems that legitimately require access.
• Block unnecessary communication from workstation and user VLANs.
• Prevent direct internet exposure of backup infrastructure.
• Apply host-based firewall restrictions where operationally appropriate.
• Monitor access to Veeam services from unexpected systems.
• Review administrative and backup configuration changes.
• Monitor the backup server for unusual process execution or outbound connections.
• Protect administrative credentials using strong authentication and least privilege.
• Maintain immutable or offline backup copies where possible.

These controls reduce attack surface but should not be considered substitutes for the vendor update.

Veeam’s release information states that 13.1.2.57 is a cumulative patch addressing security vulnerabilities along with other reported issues. The patch can be distributed through Veeam’s update mechanisms or installed using updated installation media.

After upgrading, administrators should verify that the expected fixed build is running.

They should also confirm that backup and replication jobs operate normally and test restoration capabilities. Security updates to backup infrastructure should not be considered complete until recoverability has been validated.

Because no vulnerability-specific exploit indicators are currently public, organizations should review historical activity on systems that remained vulnerable before patching.

Important sources include:

• Veeam service logs
• Windows Event Logs
• Veeam configuration and job history
• EDR telemetry from backup servers
• Firewall and network flow logs
• Authentication records
• Administrative activity
• vCenter and virtualization management logs

Security teams should investigate unexpected changes to jobs, repositories, replication configuration, protection policies, infrastructure components, or administrative accounts.

Backup integrity should also be verified.

Attackers frequently target backup systems during broader intrusions to impair recovery. Even though public reporting does not establish ransomware exploitation of this CVE, organizations investigating suspicious activity should confirm that restore points, immutable copies, and offline backups have not been altered.

Where compromise cannot be excluded, incident responders should protect clean backup copies before conducting remediation.

Credentials accessible from the backup infrastructure should also be reviewed and rotated if evidence indicates unauthorized access.

Organizations running Veeam Agent for Linux managed by Backup & Replication should separately upgrade vulnerable agents to version 13.1.2, build 13.1.2.11, to remediate CVE-2026-105477.

The critical authorization bypass and the three additional vulnerabilities were reported to Veeam through HackerOne. Veeam released fixes for all four issues on October 27, 2026.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new threat intelligence and detection content are continuously added.