[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK14qnMXESWw4PAnueeEFiZsYWvU8jzd7e1EFcjmeAzM":3},{"article":4,"iocs":48,"watch_terms":64,"solutions":65,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"63985e70-7f95-4917-b626-84b872e62b8e","Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability","veeam-patches-critical-backup-replication-authorization-bypass-vulnerability-87aed5","Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service. Tracked as CVE-2026-108142, the flaw carries a CVSS v4.0 score of 9.1 and affects both Windows-based deployments and the Veeam Software Appliance. The company disclosed […] The post Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability appeared first on Cyber Security News.","Veeam released security fixes for CVE-2026-108142, a critical authorization bypass vulnerability in Veeam Backup & Replication that allows unauthenticated attackers to bypass access checks on the CDP Coordinator Service. The flaw affects versions 13.0.2.29 and earlier in the 13.0 branch and 13.1.1.18 and earlier in the 13.1 branch, with fixed versions starting at 13.0.3.63 and 13.1.2.57. The advisory also addresses two medium-severity file-write vulnerabilities and a high-severity privilege escalation flaw in Veeam Agent for Linux.","Veeam patches critical authorization bypass in Backup & Replication (CVE-2026-108142, CVSS 9.1)","https:\u002F\u002Fcybersecuritynews.com\u002Fveeam-patches-authorization-bypass-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FVeeam-patches-critical-Backup-Replication-authorization-bypass-Vulnerability.webp","2026-10-28T11:31:47+00:00","2026-10-28T12:00:26.96586+00:00",9,[17,20,23,25],{"name":18,"type":19},"Veeam","vendor",{"name":21,"type":22},"Veeam Backup & Replication","product",{"name":24,"type":22},"Veeam Agent for Linux",{"name":26,"type":22},"Veeam Software Appliance","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[49,53,56,58,61],{"type":50,"value":51,"context":52},"cve","CVE-2026-108142","Critical authorization bypass in Veeam Backup & Replication CDP Coordinator Service, CVSS 9.1",{"type":50,"value":54,"context":55},"CVE-2026-108140","Medium-severity file-write vulnerability in Veeam Backup & Replication, CVSS 5.9",{"type":50,"value":57,"context":55},"CVE-2026-108141",{"type":50,"value":59,"context":60},"CVE-2026-105477","High-severity local privilege escalation in Veeam Agent for Linux, CVSS 7.3",{"type":50,"value":62,"context":63},"CVE-2024-40711","Prior Veeam vulnerability exploited by attackers to deploy Frag ransomware",[18,21,24],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":97,"name":98,"problem":99,"products":100},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":126,"name":127,"problem":128,"products":129},"patch-management","Automated patch management","Known holes get closed in days, not months.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",[155,161],{"slug":156,"name":157,"logo_path":158,"roles":159},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png",[160],"reported_by",{"slug":162,"name":18,"logo_path":163,"roles":164},"veeam","\u002Fvendor-logos\u002Fveeam.png",[165],"affected",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"critical-veeam-auth-bypass-demands-immediate-patching-of-backup-infrastructure","Critical Veeam Auth Bypass Demands Immediate Patching of Backup Infrastructure","A critical authorization bypass vulnerability (CVE-2026-108142) in Veeam Backup & Replication allowed unauthenticated attackers to bypass access controls on the CDP Coordinator Service, putting backup data and infrastructure at severe risk without requiring any credentials. Backup systems are high-value targets because compromising them can undermine an organization's entire recovery capability, making this flaw especially dangerous. Veeam has released fixed versions, but organizations running unpatched instances remain exposed to full unauthorized access. This incident underscores that backup platforms are not exempt from rigorous vulnerability management and must be treated as critical, internet-adjacent infrastructure requiring timely patching.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement vulnerability handling and patching policies; backup infrastructure protecting critical services falls squarely under these obligations, demanding rapid response to this critical advisory.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches promptly, which would have driven timely remediation of this Veeam flaw in any cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; applying this control would have mandated rapid deployment of Veeam's fixed versions upon advisory release.","Running Veeam versions 13.0.2.29 or 13.1.1.18 without applying available security patches is a textbook instance of the risk posed by outdated components with known critical vulnerabilities.","Regular vulnerability scanning and a defined remediation timeline would have identified CVE-2026-108142 in Veeam Backup & Replication and ensured patching before unauthenticated attackers could exploit the CDP Coordinator Service bypass.","This control requires timely identification and remediation of technical vulnerabilities in software, directly applicable to the need to track and patch Veeam Backup & Replication across all affected branch versions.","The vulnerability allowed complete bypass of authentication on the CDP Coordinator Service; adherence to PR.AA's requirement for enforced access controls would have limited exposure even prior to patching."]