Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365
Veeam Backup & Replication 13, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE
On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940).
Why this severity: CVSS 4.0 9.1 for the unauthenticated CDP Coordinator authorization bypass (CVE-2026-108142) and 9.0 for the Backup for Microsoft 365 SQL injection (CVE-2026-106076, needs an authenticated organization-transfer peer); Veeam's bulletins do not mention exploitation
- Started
- Oct 27, 2026
Affected
- Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds
- Veeam Backup & Replication 13.0.2.29 and earlier 13.0 builds (12.x not affected)
- Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds, when managed by Backup & Replication
- Veeam Backup for Microsoft 365 8.6.0.1102 and earlier version 8 builds (8.5.0.1014 and earlier for CVE-2026-106076 and CVE-2026-106077)
- Veeam ONE 13.1.0.7233 and earlier 13.1 builds
Fixed in
- Veeam Backup & Replication 13.1.2 (build 13.1.2.57)
- Veeam Backup & Replication 13.0.3 (build 13.0.3.63)
- Veeam Agent for Linux 13.1.2 (build 13.1.2.11)
- Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)
- Veeam ONE 13.1 P1 (build 13.1.0.7940)
Timeline3
Veeam publishes KB4948: Backup & Replication 13.1.2 and 13.0.3 fix the critical unauthenticated CDP Coordinator authorization bypass CVE-2026-108142, two NAS restore path traversal bugs, and an Agent for Linux privilege escalation.
Veeam publishes KB4957: Backup for Microsoft 365 8.6 and 8.6 Patch 1 fix a critical cross-tenant SQL injection with code execution (CVE-2026-106076), an arbitrary file read, a REST API authentication bypass and an installer file-write bug.
Veeam publishes KB4951: Veeam ONE 13.1 P1 fixes an MFA bypass for attackers with Administrator credentials (CVE-2026-107671).
Advisories3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
