Veeam Backup & Replication patches CVE-2026-108142: a critical unauthenticated flaw, versions to install
Veeam fixes CVE-2026-108142, a critical unauthenticated flaw in Backup & Replication 13, and an MFA bypass in Veeam ONE. Affected versions, fixes and checks.
The short answer: on 27 October 2026, Veeam released Backup & Replication 13.1.2 and 13.0.3, which fix CVE-2026-108142, a critical flaw (CVSS v4.0 9.1) in the CDP Coordinator Service. An attacker without credentials can bypass this service’s authorization checks. The same day, Veeam ONE 13.1 P1 fixed an MFA bypass. No exploitation has been reported so far: this is exactly the time to update.
The backup server is the last line of defence against ransomware. An attacker who controls it can delete the copies before encrypting everything else, as explained in our guide to recovering from a ransomware attack. A flaw exploitable without authentication on that server is therefore a priority.
What is fixed
Veeam bulletin KB4948, published on 27 October 2026, covers four flaws reported through HackerOne:
- CVE-2026-108142 (critical, 9.1): authorization bypass on the CDP Coordinator Service, exploitable by an unauthenticated attacker.
- CVE-2026-108140 and CVE-2026-108141 (medium, 5.9): an authenticated user holding the Restore Operator role, who also controls the contents of a backed-up NAS share, can write files to an arbitrary path on the backup server through path traversal.
- CVE-2026-105477 (high, 7.3): local privilege escalation in Veeam Agent for Linux, only for agents managed by a Backup & Replication server.
Bulletin KB4951, published the same day, fixes CVE-2026-107671 (high, 8.5) in Veeam ONE: an attacker with valid administrator credentials can bypass MFA by disabling it globally before completing verification.
Morocco’s maCERT (DGSSI) relayed bulletin KB4948 on 28 October 2026 (bulletin 70112810/26), with an “important” risk and impact level.
Affected and fixed versions
| Product | Affected versions | Fixed version |
|---|---|---|
| Veeam Backup & Replication 13.1 (Windows and Veeam Software Appliance) | 13.1.1.18 and earlier 13.1 builds | 13.1.2 (build 13.1.2.57) |
| Veeam Backup & Replication 13.0 (Windows and Veeam Software Appliance) | 13.0.2.29 and earlier 13.0 builds | 13.0.3 (build 13.0.3.63) |
| Veeam Backup & Replication 12.x | not affected according to Veeam | n/a |
| Veeam Agent for Linux 13.1 (managed by VBR) | 13.1.1.4 and earlier 13.1 builds | 13.1.2 (build 13.1.2.11) |
| Veeam ONE 13.1 | 13.1.0.7233 and earlier 13.1 builds | 13.1 P1 (build 13.1.0.7940) |
Veeam states that Veeam Agent for Linux 13.0.x and 6.x, and Veeam ONE 13.0.x and 12.x, are not affected by these flaws. Not being affected by this bulletin does not remove the need to check that your branch is still supported.
Severity and exploitation
- Published severity: 9.1 (critical) under CVSS v4.0 for CVE-2026-108142, according to Veeam and NVD, network vector, no privileges required. NVD lists weakness CWE-636.
- Exploitation: not reported. As of 30 October 2026, CVE-2026-108142 is not in the CISA KEV catalogue.
- Our reading: Veeam warns in its bulletin that attackers usually try to reverse-engineer published patches to target unpatched installations. Older Veeam flaws, such as CVE-2024-40711, are already in the CISA KEV catalogue: these servers attract attackers.
Interim measures
Veeam lists no workaround. Until your update window:
- Isolate the backup server: no access from the internet, flows limited to the machines that need them, server outside the production Active Directory domain where possible.
- Restrict roles: review who holds Restore Operator and administrator roles in the console, and remove unused accounts. Our guide to managing administrator accounts details the method.
- Keep a copy out of reach: at least one immutable or offline copy, following the 3-2-1 immutable rule.
- Keep MFA enabled on the console and on Veeam ONE, and watch for any change to its settings, as explained in our MFA rollout guide.
Checks to run
- Inventory every Backup & Replication server, every Veeam ONE and every Linux agent, with its exact build number.
- Compare against the table above and schedule the update, starting with the most exposed servers.
- Back up the Veeam configuration before updating, then check that jobs and copies resume normally afterwards.
- Review the logs: console logins from unusual addresses, deleted or modified jobs, role changes, MFA being disabled.
- Test a restore after the update, using the backup restore testing method we apply.
Our reading for businesses in Morocco
We often see Veeam servers installed once and rarely updated afterwards, sometimes joined to the domain and reachable from the whole network. For a refresher on good practice, see our Veeam best practices for virtual machines and our Veeam partner page.
How we can help
We check your versions, apply Veeam patches in a controlled window, isolate the backup server and test a restore. We then provide 24/7 monitoring of your backups, with critical incidents handled in under 15 minutes. Discover our backup and business continuity offer and our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: Veeam bulletin KB4948, Veeam bulletin KB4951 (Veeam ONE), NVD CVE-2026-108142, CISA KEV catalogue, maCERT bulletin 70112810/26 (DGSSI).
Frequently asked questions
Is my Veeam version affected?
According to bulletin KB4948, affected releases are Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, on Windows as well as on the Veeam Software Appliance. Older versions such as 12.x are not affected by these flaws. The build number is shown in the console under Help, then About.
Is the flaw being exploited?
As of 30 October 2026, Veeam reports no exploitation and CVE-2026-108142 is not in the CISA KEV catalogue. Veeam does warn that attackers often reverse-engineer published patches to target unpatched servers. Backup servers being a favourite ransomware target, do not wait.
Is there a workaround until the update?
No. Bulletin KB4948 lists no workaround: the only fix is installing version 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). In the meantime, restrict network flows to the backup server to the strict minimum; this reduces exposure without removing it.
Should Veeam ONE and Veeam Agent for Linux be updated too?
Yes, if you use them. Bulletin KB4951 fixes CVE-2026-107671 (8.5) in Veeam ONE 13.1, which lets an administrator disable MFA before completing it: install Veeam ONE 13.1 P1 (build 13.1.0.7940). Veeam Agent for Linux 13.1.1.4 and earlier, managed by a Backup & Replication server, must move to 13.1.2 (build 13.1.2.11).
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
