{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365 · updates",
  "home_page_url": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142",
  "feed_url": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/feed.json",
  "description": "On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940).",
  "language": "en",
  "_pwn": {
    "slug": "veeam-october-2026-security-updates-cve-2026-108142",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/feed.xml",
    "llms": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142/llms.txt",
    "json": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-4bf35ca2",
      "url": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-4bf35ca2",
      "title": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4948: Backup & Replication 13.1.2 and 13.0.3 fix the critical unauthenticated CDP Coordinator authorization bypass CVE-2026-108142, two NAS restore path traversal bugs, and an Agent for Linux privilege escalation.",
      "content_text": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4948: Backup & Replication 13.1.2 and 13.0.3 fix the critical unauthenticated CDP Coordinator authorization bypass CVE-2026-108142, two NAS restore path traversal bugs, and an Agent for Linux privilege escalation.\n\nSource: https://www.veeam.com/kb4948",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://www.veeam.com/kb4948",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-a16f7410",
      "url": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-a16f7410",
      "title": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4957: Backup for Microsoft 365 8.6 and 8.6 Patch 1 fix a critical cross-tenant SQL injection with code execution (CVE-2026-106076), an arbitrary file read, a REST API authentication bypass and an installer file-write bug.",
      "content_text": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4957: Backup for Microsoft 365 8.6 and 8.6 Patch 1 fix a critical cross-tenant SQL injection with code execution (CVE-2026-106076), an arbitrary file read, a REST API authentication bypass and an installer file-write bug.\n\nSource: https://www.veeam.com/kb4957",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://www.veeam.com/kb4957",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-f0553d9f",
      "url": "https://pwn.watch/i/veeam-october-2026-security-updates-cve-2026-108142#2026-10-27-f0553d9f",
      "title": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4951: Veeam ONE 13.1 P1 fixes an MFA bypass for attackers with Administrator credentials (CVE-2026-107671).",
      "content_text": "Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365: Veeam publishes KB4951: Veeam ONE 13.1 P1 fixes an MFA bypass for attackers with Administrator credentials (CVE-2026-107671).\n\nSource: https://www.veeam.com/kb4951",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://www.veeam.com/kb4951",
      "tags": [
        "critical"
      ]
    }
  ]
}