CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day
Veeam fixes an unauthenticated 9.1 authorization bypass on 13.x servers, a VB365 SQL injection and a ONE MFA bypass
Defender actions
- Upgrade every Veeam Backup & Replication 13.x server and Veeam Software Appliance to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Veeam Backup for Microsoft 365 to 8.6 Patch 1 (build 8.6.0.5011) and Veeam ONE 13.1 to Patch 1 (build 13.1.0.7940), because Veeam names no workaround and warns that attackers reverse-engineer its patches.
Analysis
Veeam published three advisories on 2026-10-27. In Backup & Replication, CVE-2026-108142 (CVSS 4.0 9.1, critical) lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication and of the Veeam Software Appliance; it affects 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, is fixed in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63), and does not affect 12.x (Veeam KB4948, 2026-10-27). The same advisory fixes two medium path-traversal flaws that need the Restore Operator role plus control over the contents of a backed-up NAS share and that write attacker-controlled files to an arbitrary path on the backup server, and a local privilege escalation in Veeam Agent for Linux version 13.1.1.4 and earlier that applies only to agents managed by a Backup & Replication server (Veeam KB4948, 2026-10-27). Veeam Backup for Microsoft 365 8.5.0.1014 and earlier carry CVE-2026-106076 (9.0, critical): an authenticated organization-transfer peer injects SQL into the source server's configuration database, which gives cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account; the fix is 8.6 (build 8.6.0.1102), as it is for CVE-2026-106077 (8.3), which lets a user with the Backup for Microsoft 365 Administrator role read arbitrary files on the backup server as LocalSystem; two further flaws, an unauthenticated REST API authentication bypass with a forged federation token (6.9) and an installer file-write (4.3), need 8.6 Patch 1 (build 8.6.0.5011) (Veeam KB4957, 2026-10-27). Veeam ONE 13.1.0.7233 and earlier let an attacker with valid Administrator credentials disable multi-factor authentication globally before completing MFA verification (8.5, high; fixed in 13.1 P1, build 13.1.0.7940) (Veeam KB4951, 2026-10-27).
NCSC Switzerland relayed the Backup & Replication and Veeam ONE advisories on 2026-10-28, lists the exploitation status as unknown with the vendor reporting no evidence of active exploitation, and gives the prerequisite for the critical flaw as network access to the backup server's CDP Coordinator Service (NCSC Switzerland, 2026-10-28). heise adds that backup servers are a favourite target of ransomware groups (translated from German) (heise online, 2026-10-28), and Veeam itself says attackers will likely try to reverse-engineer a disclosed patch to exploit unpatched deployments (Veeam KB4948, 2026-10-27).
Cited evidence
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Note: Older versions (e.g., 12.x) are not affected.
leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
UNKNOWN (the vendor reports no evidence of active exploitation)
attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.