Veeam Backup for Microsoft 365 REST API authentication bypass with a forged federation token (CVSS 4.0 6.9, 8.6.0.1102 and earlier), fixed in 8.6 Patch 1

CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day

Veeam published three advisories on 2026-10-27. In Backup & Replication, CVE-2026-108142 (CVSS 4.0 9.1, critical) lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication and of the Veeam Software Appliance; it affects 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, is fixed in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63), and does not affect 12.x (Veeam KB4948, 2026-10-27). The same advisory fixes two medium path-traversal flaws that need the Restore Operator role plus control over the contents of a backed-up NAS share and that write attacker-controlled files to an arbitrary path on the backup server, and a local privilege escalation in Veeam Agent for Linux version 13.1.1.4 and earlier that applies only to agents managed by a Backup & Replication server (Veeam KB4948, 2026-10-27). Veeam Backup for Microsoft 365 8.5.0.1014 and earlier carry CVE-2026-106076 (9.0, critical): an authenticated organization-transfer peer injects SQL into the source server's configuration database, which gives cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account; the fix is 8.6 (build 8.6.0.1102), as it is for CVE-2026-106077 (8.3), which lets a user with the Backup for Microsoft 365 Administrator role read arbitrary files on the backup server as LocalSystem; two further flaws, an unauthenticated REST API authentication bypass with a forged federation token (6.9) and an installer file-write (4.3), need 8.6 Patch 1 (build 8.6.0.5011) (Veeam KB4957, 2026-10-27). Veeam ONE 13.1.0.7233 and earlier let an attacker with valid Administrator credentials disable multi-factor authentication globally before completing MFA verification (8.5, high; fixed in 13.1 P1, build 13.1.0.7940) (Veeam KB4951, 2026-10-27).

NCSC Switzerland relayed the Backup & Replication and Veeam ONE advisories on 2026-10-28, lists the exploitation status as unknown with the vendor reporting no evidence of active exploitation, and gives the prerequisite for the critical flaw as network access to the backup server's CDP Coordinator Service (NCSC Switzerland, 2026-10-28). heise adds that backup servers are a favourite target of ransomware groups (translated from German) (heise online, 2026-10-28), and Veeam itself says attackers will likely try to reverse-engineer a disclosed patch to exploit unpatched deployments (Veeam KB4948, 2026-10-27).