Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability
Veeam patches critical authorization bypass in Backup & Replication (CVE-2026-108142, CVSS 9.1)
Veeam released security fixes for CVE-2026-108142, a critical authorization bypass vulnerability in Veeam Backup & Replication that allows unauthenticated attackers to bypass access checks on the CDP Coordinator Service. The flaw affects versions 13.0.2.29 and earlier in the 13.0 branch and 13.1.1.18 and earlier in the 13.1 branch, with fixed versions starting at 13.0.3.63 and 13.1.2.57. The advisory also addresses two medium-severity file-write vulnerabilities and a high-severity privilege escalation flaw in Veeam Agent for Linux.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Veeam?
Get an email when a new story names Veeam, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical authorization bypass vulnerability (CVE-2026-108142) in Veeam Backup & Replication allowed unauthenticated attackers to bypass access controls on the CDP Coordinator Service, putting backup data and infrastructure at severe risk without requiring any credentials. Backup systems are high-value targets because compromising them can undermine an organization's entire recovery capability, making this flaw especially dangerous. Veeam has released fixed versions, but organizations running unpatched instances remain exposed to full unauthorized access. This incident underscores that backup platforms are not exempt from rigorous vulnerability management and must be treated as critical, internet-adjacent infrastructure requiring timely patching.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-108142
- cve — CVE-2026-108140
- cve — CVE-2026-108141
- cve — CVE-2026-105477
- cve — CVE-2024-40711