Veeam Patches Critical Authorization Bypass Vulnerability in Backup & Replication

Veeam has issued urgent security fixes for a critical authorization bypass vulnerability, identified as CVE-2026-108142, within its widely-used Veeam Backup & Replication software. This flaw, which carries a CVSS v4.0 score of 9.1, allows unauthenticated attackers to bypass access controls on the CDP (Continuous Data Protection) Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance, impacting versions 13.1.1.18 and earlier in the 13.1 branch, as well as 13.0.2.29 and earlier in the 13.0 branch. Veeam has confirmed that version 12.x is not affected by this particular issue.

The vulnerability specifically targets the authorization mechanisms that govern user actions. While the advisory does not detail the exact attack sequence or confirm remote code execution capabilities, the bypass of access controls on a critical service like CDP Coordinator presents a significant security risk. Veeam has not reported any instances of active exploitation in the wild related to CVE-2026-108142.

In addition to the critical authorization bypass, Veeam's security update also addresses two medium-severity file-write vulnerabilities (CVE-2026-108140 and CVE-2026-108141), each with a CVSS v4.0 score of 5.9. These flaws require an authenticated user with the Restore Operator role who also controls the contents of a backed-up network-attached storage (NAS) share. Under these specific conditions, an attacker could leverage relative path traversal to write arbitrary files to the backup server. The same affected and fixed versions of Backup & Replication apply to these vulnerabilities.

Furthermore, the update includes a fix for a high-severity local privilege escalation vulnerability (CVE-2026-105477) affecting Veeam Agent for Linux. This issue, rated with a CVSS score of 7.3, impacts installations managed by Backup & Replication, specifically versions 13.1.1.4 and earlier 13.1 builds. The patched version for this vulnerability is 13.1.2, build 13.1.2.11.

All four vulnerabilities were reported to Veeam through HackerOne. The company has released the first fixed versions as Backup & Replication 13.1.2, build 13.1.2.57, and Backup & Replication 13.0.3, build 13.0.3.63. Administrators are advised to verify their installed build numbers against these fixed versions, as checking only the main product version may not be sufficient.

This patch release comes at a time when backup solutions are increasingly targeted by threat actors, as evidenced by previous reports of attackers exploiting Veeam vulnerabilities to deploy ransomware. The timely application of these security updates is crucial, as attackers may analyze released patches to identify and exploit unpatched systems. Veeam urges administrators to promptly update their affected backup servers and managed Linux agents to mitigate these risks.