Veeam CVE-2026-108142: patch your backup server to 13.1.2
Veeam CVE-2026-108142 lets an unauthenticated attacker bypass authorization in Backup & Replication 13. Update to 13.1.2 or 13.0.3 now.
Veeam fixed CVE-2026-108142, a critical flaw in Veeam Backup & Replication 13 that needs no login. An unauthenticated attacker can bypass authorization on the CDP Coordinator Service. Veeam scores it 9.1 on CVSS v4.0. Your backup server is the last thing that stands between ransomware and a ransom payment. Patch it this week.
What actually happened
Veeam published KB4948 on October 27, 2026. It fixes four vulnerabilities, all reported through HackerOne:
- CVE-2026-108142 (critical, 9.1): authorization bypass on the CDP Coordinator Service. No authentication needed.
- CVE-2026-108140 and CVE-2026-108141 (medium, 5.9 each): a user with the Restore Operator role who controls a backed-up NAS share can write files to any path on the backup server through path traversal.
- CVE-2026-105477 (high, 7.3): local privilege escalation in Veeam Agent for Linux, only when a Backup & Replication server manages it.
Affected: Backup & Replication 13.1.1.18 and all earlier 13.1 builds, and 13.0.2.29 and all earlier 13.0 builds, on Windows and on the Veeam Software Appliance. Veeam says 12.x is not affected.
Fixed: 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63). Veeam Agent for Linux is fixed in 13.1.2.11.
Veeam's advisory does not report exploitation in the wild and gives no workaround. It does warn that attackers usually reverse-engineer a patch soon after it ships.
Why a backup server CVE matters for your business
Ransomware crews go for backups first. If they can wipe or encrypt your restore points, you have no choice but to pay. Veeam flaws have been a target before, so treat "not exploited yet" as a short window, not a free pass.
What to do:
Check your version today. Open the Veeam console and confirm the build number. If it starts with 13 and is below 13.0.3.63 or 13.1.2.57, you are exposed.
Update, then update the agents. Install 13.1.2 or 13.0.3. Then update managed Linux agents to 13.1.2.11.
Get the backup server off the open network. It should not be reachable from the internet or from ordinary user networks. Put it on a management segment.
Keep one copy the backup server cannot delete. Immutable or offline storage is the copy that survives when the server itself is the target.
Key takeaways
- CVE-2026-108142 is an unauthenticated authorization bypass in Veeam Backup & Replication 13, CVSS v4.0 score 9.1
- Affected: 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds; 12.x is not affected
- Fixed in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63); Linux agent fixed in 13.1.2.11
- Veeam reports no known exploitation yet, but warns attackers reverse-engineer patches
- Isolate the backup server and keep an immutable copy it cannot delete
A backup is only a backup if an attacker cannot reach it. We set up patch tracking, segmented networks and immutable backup copies for small teams that do not have a full-time IT department. See how we harden small-business infrastructure, or ask us to check your backup setup.
Sources: Veeam KB4948, SecurityOnline.
- #veeam
- #backup
- #cve-2026-108142
- #patch-management
- #ransomware
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Trojanized Claude Code extension hit Cursor: check your SSH keys
A tampered Claude Code extension in Cursor's marketplace planted an SSH backdoor for 11 hours. Uninstalling isn't enough. Here's what to check today.
Read itServiceNow CVE-2026-103093: admin sandbox escape, patch it
CVE-2026-103093 lets a ServiceNow admin escape the Rhino sandbox and run code on the host. CVSS 9.4. Patch self-hosted instances and cut your admin list.
Read it