Veeam releases patches for critical authorization bypass vulnerability

Veeam has issued security updates to address a critical authorization bypass vulnerability, tracked as CVE-2026-108142, in its Backup & Replication software. The flaw, which carries a CVSS v4.0 score of 9.1, affects the CDP Coordinator Service and allows unauthenticated attackers with network access to bypass access checks without requiring login credentials or user interaction.

The vulnerability impacts both Windows-based deployments and the Veeam Software Appliance. Specifically, it affects versions 13.1.1.18 and earlier in the 13.1 branch, as well as 13.0.2.29 and earlier in the 13.0 branch. Version 12.x is reported as unaffected.

In addition to the critical bypass, the security advisory KB4948 addresses two medium-severity file-write vulnerabilities (CVE-2026-108140 and CVE-2026-108141) involving relative path traversal. A separate advisory, KB4951, addresses a high-severity MFA bypass in Veeam ONE (CVE-2026-107671), while CVE-2026-105477 covers a high-severity local privilege escalation in Veeam Agent for Linux.

Administrators are advised to update to Backup & Replication 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63) to mitigate these risks. There are currently no reports of active exploitation.