Veeam Patches Five Critical and High Vulnerabilities in Backup & Replication and Veeam ONE
Do Son 
TL;DR
Veeam published two security advisories on October 27, 2026, resolving five Veeam vulnerabilities across its enterprise backup and monitoring software. The most severe flaw, CVE-2026-108142 (CVSS v4.0: 9.1), allows unauthenticated attackers to bypass authorization on the CDP Coordinator Service. System administrators must apply the latest software updates immediately to protect their backup infrastructure.
- Total: 5 CVEs
- Severity: 1 Critical · 2 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.1 (Critical · CVSSv4) — CVE-2026-108142
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-108142 | 9.1 | 13.0.3, 13.1.2 | Not exploited |
| CVE-2026-107671 | 8.5 | — | Not exploited |
| CVE-2026-105477 | 7.3 | 13.1.2 | Not exploited |
| CVE-2026-108140 | 5.9 | 13.0.3, 13.1.2 | Not exploited |
| CVE-2026-108141 | 5.9 | 13.0.3, 13.1.2 | Not exploited |
Why It Matters
Veeam Data Platform solutions protect data across more than 550,000 organizations worldwide. While exact counts of exposed version 13 deployments are not specified in the advisories, enterprise backup servers remain top targets for ransomware operators.
Leaving these Veeam vulnerabilities unpatched risks unauthorized service access, MFA bypass, and arbitrary file writes. Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.
How the Attack Works
All five flaws were reported through the HackerOne bug bounty platform and affect authentication, file restoration, and local agent permissions.
Authorization and MFA Bypasses
According to the official Veeam KB4948 security advisory, the critical flaw CVE-2026-108142 (CVSS 9.1) lets an unauthenticated attacker bypass authorization checks on the Continuous Data Protection (CDP) Coordinator Service across Windows and Veeam Software Appliance deployments. Meanwhile, the Veeam ONE KB4951 security advisory details CVE-2026-107671 (CVSS 8.5). This high-severity bug lets an attacker with valid Administrator credentials disable multi-factor authentication globally before completing the MFA verification step.
Privilege Escalation and Path Traversal
Furthermore, CVE-2026-105477 (CVSS 7.3) allows local privilege escalation in Veeam Agent for Linux when managed by a Veeam Backup & Replication server. Finally, CVE-2026-108140 and CVE-2026-108141 (both CVSS 5.9) allow an authenticated Restore Operator who controls a backed-up NAS share to write arbitrary files to the backup server. This is possible via relative path traversal.
Affected Versions
These Veeam vulnerabilities only impact version 13 releases; older 12.x and 6.x branches are unaffected. Specifically, CVE-2026-108142, CVE-2026-108140, and CVE-2026-108141 affect Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds. They also affect 13.0.2.29 and earlier 13.0 builds. CVE-2026-105477 impacts Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds. Meanwhile, CVE-2026-107671 affects Veeam ONE 13.1.0.7233 and earlier 13.1 builds.
Patch and Mitigation Steps
Administrators must upgrade Veeam Backup & Replication to version 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). Additionally, operators should update Veeam Agent for Linux to 13.1.2 (build 13.1.2.11). They must also patch Veeam ONE to 13.1 P1 (build 13.1.0.7940) without delay.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
