On 27 October 2026 Veeam released fixes for five vulnerabilities in Veeam Backup & Replication, Veeam Agent for Linux and Veeam ONE. The critical Veeam Backup & Replication vulnerability is CVE-2026-108142, an authorization bypass in the CDP Coordinator Service. An attacker needs no login, and Veeam rates it 9.1 on the CVSS v4.0 scale.
It affects Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds. Veeam says older versions such as 12.x are not affected. Run 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63).
The flaw has its own CVE-2026-108142 page, and so does the Veeam ONE flaw, CVE-2026-107671.
Last updated: 28 October 2026. We update this page if Veeam revises its notes.
What Did Veeam Fix on 27 October?
Veeam lists the flaws in two articles: KB4948 for Backup & Replication and the Linux agent, and KB4951 for Veeam ONE. The three Backup & Replication flaws apply to the Windows-based product and the Veeam Software Appliance.
| CVE | Flaw (Veeam’s description, shortened) | CVSS v4.0 | Affected builds | Fixed build | Older versions, per Veeam |
|---|---|---|---|---|---|
| CVE-2026-108142 | Unauthenticated attacker bypasses authorization on the CDP Coordinator Service | 9.1 Critical | Backup & Replication 13.1.1.18 and earlier 13.1 builds; 13.0.2.29 and earlier 13.0 builds | 13.1.2.57; 13.0.3.63 | Older versions (e.g., 12.x) are not affected |
| CVE-2026-108140 | Restore Operator who controls a backed-up NAS share writes files to any path on the backup server | 5.9 Medium | Same as above | 13.1.2.57; 13.0.3.63 | Older versions (e.g., 12.x) are not affected |
| CVE-2026-108141 | Same text as CVE-2026-108140 | 5.9 Medium | Same as above | 13.1.2.57; 13.0.3.63 | Older versions (e.g., 12.x) are not affected |
| CVE-2026-105477 | Local privilege escalation in Veeam Agent for Linux; only installations managed by a Backup & Replication instance | 7.3 High | Agent for Linux 13.1.1.4 and earlier 13.1 builds | 13.1.2.11 | Older versions (e.g., 13.0.x and 6.x) are not affected |
| CVE-2026-107671 | Attacker with valid Administrator credentials bypasses multi-factor authentication by disabling it globally | 8.5 High | Veeam ONE 13.1.0.7233 and earlier 13.1 builds | 13.1 P1 (13.1.0.7940) | Older versions (e.g., 13.0.x and 12.x) are not affected |
The 13.1.2 patch comes through Veeam Updater. Veeam’s release information says it reaches Veeam Software Appliance 13.1 installations first and Windows-based 13.1 deployments gradually.
On the 13.0 line, Veeam’s release notes list the three Backup & Replication fixes in 13.0.3 (build 13.0.3.63), a release the page dates 25 August 2026. Both articles repeat Veeam’s standard warning that attackers will likely reverse-engineer a disclosed patch. It is a general note, not a report about these flaws.
The same day Veeam published KB4957 with four fixes for Veeam Backup for Microsoft 365, including CVE-2026-106076 (Critical, CVSS v4.0 9.0). This post does not cover them.
What Does Veeam Not Say About the CDP Flaw?
Veeam gives no exploit detail. Its article does not say which port the flaw is reachable on, or whether a server with no CDP policies is affected. Veeam and NVD both write authorization bypass: an unauthenticated attacker bypasses authorization on the CDP Coordinator Service.
Here is our reading of Veeam’s documentation. The port tables show the CDP ports as links inside the backup infrastructure. The backup server receives TCP 33034 from CDP proxies, ESXi hosts and vCenter Server, and TCP 33035 from vCenter Server and ESXi hosts. Nothing in the documentation or in KB4948 says the service faces the internet by default.
Service providers should check first: Veeam’s Cloud Connect port list names TCP 6185, 33034 and 33035 on the service provider backup server for this service.
Why Do Backup Servers Attract Ransomware Crews?
CISA’s Known Exploited Vulnerabilities catalog lists four earlier Backup & Replication flaws, each flagged as used in ransomware campaigns: CVE-2022-26500, CVE-2022-26501 (see our post on those two flaws), CVE-2023-27532 and CVE-2024-40711.
Our SafePay joint advisory post covers two of them, and the Akira ransomware profile records Akira actors exploiting unpatched Veeam servers.
- CISA KEVNot seenNone of the five CVEs is in the catalog release of 27 October 202627 Oct
- Exploitation reported by VeeamUnknownThe two articles describe no exploitation27 Oct
- Earlier Veeam flaws in KEVYesFour Backup & Replication entries, each flagged as used in ransomware campaigns2022 to 2024
- XYesEight posts from 27 October 20:21 UTC to 28 October 07:50 UTC, all summaries of the advisory27 to 28 Oct
We are not saying the new flaws are exploited. The history is why a critical backup server flaw is urgent, and why an immutable backup copy matters when a backup server is compromised.
How Do You Close the Gap This Week?
- List what you runNote the build of every Backup & Replication server, Linux agent and Veeam ONE server.
- Patch Backup & ReplicationMove to 13.1.2.57 or 13.0.3.63 through Veeam Updater, or with the installation media from My Account.
- Patch the agents and Veeam ONEAgent for Linux needs 13.1.2.11 and Veeam ONE needs 13.1 P1 (13.1.0.7940).
- Limit the CDP portsAllow TCP 33034 to the backup server only from CDP proxies, ESXi hosts and vCenter Server, and TCP 33035 only from vCenter Server and ESXi hosts, as in Veeam’s port table. Service providers running Cloud Connect also receive these ports from their cloud gateways. This is hardening, not a documented
- Check the hardened repositoryConfirm the immutable backup period is set. Veeam says files cannot be moved, modified or deleted during it.
- Check MFA on Veeam ONEConfirm multi-factor authentication is still on. If it is off and nobody switched it off, treat the Administrator account as compromised.