#Backup

Veeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365

On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940).

Veeam Backup & Replication 13, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE·Since Oct 27, 2026·updated Oct 27, 2026, 17:26 UTC