Veeam Backup & Replication authorization bypass (CVE-2026-108142)

Veeam describes CVE-2026-108142 as "a vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service." It rates the flaw Critical, with a CVSS v4.0 score of 9.1. The vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H. Veeam says it was reported through HackerOne.

Veeam gives no exploit detail. It does not say which port or request the bypass uses, what an attacker can do after it, or whether a server with no CDP policies is affected. Veeam and NVD both write authorization bypass.

What the Vector Implies

This is our reading of the vector, not a statement from Veeam. The attack runs over the network, with low complexity, and needs no privileges and no user. The impact on confidentiality is none and on integrity and availability high, on the vulnerable system and on connected systems.

The attack requirements are marked as present (AT:P), so some condition has to hold. Veeam does not say which.

Who Can Reach the CDP Coordinator Service?

This is our reading of Veeam's documentation. The services list names the Veeam CDP Coordinator Service (veeamcdpsvc.service) as the service that communicates with VMware vCenter, assigns continuous data protection tasks and manages the vSphere components involved.

The port tables show the CDP ports as links inside the backup infrastructure. The backup server receives TCP 33034 from CDP proxies, ESXi hosts and vCenter Server, and TCP 33035 from vCenter Server and ESXi hosts. Nothing in the documentation or in KB4948 says the service faces the internet by default.

Service providers should check first. Veeam's Cloud Connect port list names TCP 6185, 33034 and 33035 on the service provider backup server for the CDP Coordinator Service.

Same Release, Other Flaws

KB4948 lists three more flaws in the same release. CVE-2026-108140 and CVE-2026-108141 (Medium, 5.9) let a Restore Operator who controls a backed-up NAS share write files to any path on the backup server. CVE-2026-105477 (High, 7.3) is a local privilege escalation in Veeam Agent for Linux. The Veeam ONE flaw in KB4951 has its own page, CVE-2026-107671.

What Our Checks Showed

We are not saying this flaw is exploited. Backup servers are a known ransomware target, which is why a critical flaw in one is urgent. Our SafePay joint advisory post and the Akira ransomware profile cover earlier Veeam flaws used in attacks. Our news post on the October Veeam fixes covers all five CVEs together.

Veeam lists Windows-based Veeam Backup & Replication and the Veeam Software Appliance as affected. The builds are 13.1.1.18 and all earlier 13.1 builds, and 13.0.2.29 and all earlier 13.0 builds. Veeam adds: "Older versions (e.g., 12.x) are not affected."

Veeam fixed the flaw in Backup & Replication 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63). NVD's record lists 13.0 below 13.0.3 and 13.1 below 13.1.2 as affected.

Veeam's release information says the 13.1.2 patch comes through Veeam Updater. It reaches Veeam Software Appliance 13.1 installations first and Windows-based 13.1 deployments gradually. The 13.0.3 entry lists this CVE too, and the page shows its date as 25 August 2026.