---
schema: 1
kind: vulnerability
title: "CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day"
headline: "Veeam fixes an unauthenticated 9.1 authorization bypass on 13.x servers, a VB365 SQL injection and a ONE MFA bypass"
summary: >
  Veeam's advisories of 2026-10-27 fix CVE-2026-108142, an unauthenticated authorization bypass on the CDP Coordinator Service of Veeam Backup &
  Replication 13.1 and 13.0 on Windows and of the Veeam Software Appliance (CVSS 4.0 9.1, fixed in 13.1.2 and 13.0.3; 12.x is not affected),
  a SQL injection in Veeam Backup for Microsoft 365 that reaches code execution as the PostgreSQL service account (9.0, fixed in 8.6) and an MFA
  bypass in Veeam ONE 13.1 for an attacker holding Administrator credentials (8.5). NCSC Switzerland relayed the Backup & Replication and Veeam ONE
  advisories on 2026-10-28; Veeam reports no exploitation.
discovered_at: "2026-10-29T04:41:00Z"
updated_at: null
event_date: "2026-10-27"
run_id: 2026-10-29T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, auth-bypass, pre-auth, patch-available]
regions: [global]
sectors: []
entities: ["product:veeam-backup-replication", "product:veeam-one", "product:veeam-agent-for-linux", "product:veeam-backup-for-microsoft-365", "product:veeam-software-appliance"]
techniques: [T1190, T1556.006, T1068]
affected_products: ["Veeam Backup & Replication", "Veeam Software Appliance", "Veeam Backup for Microsoft 365", "Veeam ONE", "Veeam Agent for Linux"]
cves:
  - id: CVE-2026-108142
    cvss: "9.1 (CVSS 4.0)"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Veeam Backup & Replication 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, Windows-based and Veeam Software Appliance; 12.x is not affected"
    fixed: "13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63)"
  - id: CVE-2026-105477
    cvss: "7.3 (CVSS 4.0)"
    epss: null
    type: lpe
    vector: local
    auth: post-auth
    status: [patch-available]
    affected: "Veeam Agent for Linux 13.1.1.4 and all earlier 13.1 builds, only when managed by a Backup & Replication instance"
    fixed: "13.1.2 (build 13.1.2.11)"
  - id: CVE-2026-106076
    cvss: "9.0 (CVSS 4.0)"
    epss: null
    type: sqli
    vector: zero-click
    auth: post-auth
    status: [patch-available]
    affected: "Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds; Veeam says unsupported versions are likely affected"
    fixed: "8.6 (build 8.6.0.1102)"
  - id: CVE-2026-106077
    cvss: "8.3 (CVSS 4.0)"
    epss: null
    type: info-disclosure
    vector: zero-click
    auth: admin-required
    status: [patch-available]
    affected: "Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds"
    fixed: "8.6 (build 8.6.0.1102)"
  - id: CVE-2026-106078
    cvss: "6.9 (CVSS 4.0)"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds"
    fixed: "8.6 Patch 1 (build 8.6.0.5011)"
  - id: CVE-2026-107671
    cvss: "8.5 (CVSS 4.0)"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: admin-required
    status: [patch-available]
    affected: "Veeam ONE 13.1.0.7233 and all earlier 13.1 builds; 13.0.x and 12.x are not affected"
    fixed: "13.1 P1 (build 13.1.0.7940)"
sources:
  - url: "https://www.veeam.com/kb4948"
    publisher: "Veeam (KB4948)"
    date: "2026-10-27"
    role: primary
  - url: "https://www.veeam.com/kb4957"
    publisher: "Veeam (KB4957)"
    date: "2026-10-27"
    role: primary
  - url: "https://www.veeam.com/kb4951"
    publisher: "Veeam (KB4951)"
    date: "2026-10-27"
    role: primary
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13109"
    publisher: "NCSC Switzerland"
    date: "2026-10-28"
    role: corroborating
  - url: "https://www.heise.de/news/Veeam-Backup-Server-manipulierbar-und-MFA-deaktivierbar-11502821.html"
    publisher: "heise online"
    date: "2026-10-28"
    role: corroborating
closed_sources: []
evidence:
  - quote: "A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service."
    publisher: "Veeam (KB4948)"
    source_url: "https://www.veeam.com/kb4948"
  - quote: "Note: Older versions (e.g., 12.x) are not affected."
    publisher: "Veeam (KB4948)"
    source_url: "https://www.veeam.com/kb4948"
  - quote: "leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account."
    publisher: "Veeam (KB4957)"
    source_url: "https://www.veeam.com/kb4957"
  - quote: "A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification."
    publisher: "Veeam (KB4951)"
    source_url: "https://www.veeam.com/kb4951"
  - quote: "UNKNOWN (the vendor reports no evidence of active exploitation)"
    publisher: "NCSC Switzerland"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/13109"
  - quote: "attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software."
    publisher: "Veeam (KB4948)"
    source_url: "https://www.veeam.com/kb4948"
verification: single-source
sourcing_note: >
  Veeam is the disclosing party for its own products and its three knowledge-base articles are the source for every version, score and fixed build; NCSC Switzerland
  and heise restate the Backup & Replication and Veeam ONE advisories and add no assessment of their own. Veeam's pages give no exploitation statement; the
  statement that it reports no evidence of exploitation is NCSC Switzerland's. Neither Veeam nor the sources read say whether the CDP Coordinator Service runs by
  default or what the attack-requirements qualifier in the CVSS vector means in practice.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every Veeam Backup & Replication 13.x server and Veeam Software Appliance to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Veeam Backup for Microsoft 365 to 8.6 Patch 1 (build 8.6.0.5011) and Veeam ONE 13.1 to Patch 1 (build 13.1.0.7940), because Veeam names no workaround and warns that attackers reverse-engineer its patches."
updates: []
migrated_from: null
---

Veeam published three advisories on 2026-10-27. In Backup & Replication, CVE-2026-108142 (CVSS 4.0 9.1, critical) lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication and of the Veeam Software Appliance; it affects 13.1.1.18 and all earlier 13.1 builds and 13.0.2.29 and all earlier 13.0 builds, is fixed in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63), and does not affect 12.x ([Veeam KB4948, 2026-10-27](https://www.veeam.com/kb4948)). The same advisory fixes two medium path-traversal flaws that need the Restore Operator role plus control over the contents of a backed-up NAS share and that write attacker-controlled files to an arbitrary path on the backup server, and a local privilege escalation in Veeam Agent for Linux version 13.1.1.4 and earlier that applies only to agents managed by a Backup & Replication server ([Veeam KB4948, 2026-10-27](https://www.veeam.com/kb4948)). Veeam Backup for Microsoft 365 8.5.0.1014 and earlier carry CVE-2026-106076 (9.0, critical): an authenticated organization-transfer peer injects SQL into the source server's configuration database, which gives cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account; the fix is 8.6 (build 8.6.0.1102), as it is for CVE-2026-106077 (8.3), which lets a user with the Backup for Microsoft 365 Administrator role read arbitrary files on the backup server as LocalSystem; two further flaws, an unauthenticated REST API authentication bypass with a forged federation token (6.9) and an installer file-write (4.3), need 8.6 Patch 1 (build 8.6.0.5011) ([Veeam KB4957, 2026-10-27](https://www.veeam.com/kb4957)). Veeam ONE 13.1.0.7233 and earlier let an attacker with valid Administrator credentials disable multi-factor authentication globally before completing MFA verification (8.5, high; fixed in 13.1 P1, build 13.1.0.7940) ([Veeam KB4951, 2026-10-27](https://www.veeam.com/kb4951)).

NCSC Switzerland relayed the Backup & Replication and Veeam ONE advisories on 2026-10-28, lists the exploitation status as unknown with the vendor reporting no evidence of active exploitation, and gives the prerequisite for the critical flaw as network access to the backup server's CDP Coordinator Service ([NCSC Switzerland, 2026-10-28](https://security-hub.ncsc.admin.ch/#/posts/13109)). heise adds that backup servers are a favourite target of ransomware groups (translated from German) ([heise online, 2026-10-28](https://www.heise.de/news/Veeam-Backup-Server-manipulierbar-und-MFA-deaktivierbar-11502821.html)), and Veeam itself says attackers will likely try to reverse-engineer a disclosed patch to exploit unpatched deployments ([Veeam KB4948, 2026-10-27](https://www.veeam.com/kb4948)).

**Exposure:** a Veeam Backup & Replication or Veeam Software Appliance on a 13.x build below 13.1.2 or 13.0.3 whose CDP Coordinator Service accepts connections from a network the attacker can reach; 12.x is out of scope ([Veeam KB4948, 2026-10-27](https://www.veeam.com/kb4948)). Veeam Backup for Microsoft 365 version 8 below 8.6 Patch 1 ([Veeam KB4957, 2026-10-27](https://www.veeam.com/kb4957)) and Veeam ONE 13.1 below Patch 1 ([Veeam KB4951, 2026-10-27](https://www.veeam.com/kb4951)) are the other affected builds.

**Detection:** Veeam publishes no indicator. The telemetry that bears on this flaw is authentication and authorization events and service-account activity on the backup server, and new or changed backup jobs, repositories, stored credentials and restore operators; this is an inference from the described flaw, not a Veeam statement. For Veeam ONE, an MFA setting switched off followed by an Administrator sign-in is the sequence the flaw describes.

**Defender takeaway:** install the fixed builds on every backup server first, since backup infrastructure is what ransomware groups try to reach before encrypting, and keep backup servers off networks that untrusted hosts can reach; where a backup server was reachable and unpatched, review its jobs, repositories and credentials for changes nobody made.