Veeam has released urgent security updates for several of its products after disclosing a critical vulnerability in Veeam Backup & Replication that could allow an unauthenticated attacker to bypass authorization checks on the backup server. The flaw, tracked as CVE-2026-108142, carries a CVSS v4.0 score of 9.1, placing it firmly in the critical severity category.
The same security release also addresses a high-severity vulnerability in Veeam Agent for Linux, a high-severity authentication bypass issue in Veeam ONE, and two medium-severity path traversal vulnerabilities affecting Veeam Backup & Replication. Because backup infrastructure is frequently targeted by ransomware operators trying to destroy or encrypt recovery data before launching an attack, organisations running affected versions should treat these updates as a priority.
CVE-2026-108142 Is The Most Serious Issue
The most critical vulnerability in the release is CVE-2026-108142, an authorization bypass affecting the Continuous Data Protection Coordinator Service within Veeam Backup & Replication. This service runs on the backup server and is responsible for coordinating replication and data-transfer operations used by continuous data protection.
An unauthenticated attacker with network access to the backup server may be able to bypass authorization checks performed by the CDP Coordinator Service. Successful exploitation could seriously affect the integrity and availability of the backup environment and potentially impact connected systems as well.
The combination of network accessibility and the lack of an authentication requirement is what makes this vulnerability especially concerning.
The Attacker Does Not Need Valid Credentials
One of the most important aspects of CVE-2026-108142 is that exploitation does not require a legitimate Veeam account. An attacker only needs network access to the affected backup server.
That significantly lowers the barrier to exploitation compared with vulnerabilities that require administrative access or stolen credentials. If an organisation exposes its Veeam infrastructure too broadly across the network, an attacker who compromises another internal system may potentially be able to reach the backup server directly.
This is why Veeam infrastructure should ideally be heavily segmented and accessible only from trusted administrative systems.
Backup Servers Are Particularly Valuable Targets
Backup infrastructure has become one of the most important targets during modern ransomware attacks. Criminal groups frequently attempt to disable, encrypt or delete backups before encrypting production systems.
If reliable backups remain available, organisations have a much stronger chance of recovering without paying a ransom. Destroying those recovery options gives attackers much more leverage.
A vulnerability that allows unauthorized access to a backup server therefore represents much more than an ordinary software flaw. Compromising the backup platform can directly affect an organisation's ability to recover from a wider cyberattack.
Patch-Reverse Engineering Increases The Risk Over Time
Veeam has warned that attackers commonly examine security patches after they are released and compare the vulnerable and fixed versions. This allows them to determine what changed and potentially work backwards to identify the underlying vulnerability.
Once enough information is understood, attackers can attempt to build working exploits for systems that remain unpatched. That means the risk can increase rapidly after a security update becomes public.
Organisations that delay patching may therefore move from having a theoretical exposure to facing practical exploitation attempts once the vulnerability is reverse-engineered.
No Active Exploitation Has Been Reported So Far
At the time of disclosure, Veeam had not reported any known active exploitation of CVE-2026-108142. There was also no publicly available proof-of-concept exploit, and the vulnerability had not been added to the CISA Known Exploited Vulnerabilities catalogue.
That is good news, but it should not be interpreted as a reason to delay remediation. The absence of public exploitation often provides organisations with a short window to patch before attackers catch up.
Given the vulnerability's critical rating and the strategic value of backup servers, updating during that window is the safer approach.
Veeam ONE Also Has A Serious Authentication Bypass Issue
The release also fixes CVE-2026-107671, a high-severity vulnerability affecting Veeam ONE. This flaw carries a CVSS score of 8.5 and involves an authentication bypass condition.
An attacker who already has administrator-level access may be able to disable multi-factor authentication globally before MFA verification is completed. While this requires more privilege than the Veeam Backup & Replication flaw, the potential impact is still significant because it weakens a major layer of account protection.
Disabling MFA could make it easier for compromised administrative credentials to be abused across the Veeam ONE environment.
MFA Protection Should Never Be Assumed To Be Enough
The Veeam ONE issue is a useful reminder that security controls such as MFA are only as strong as the systems enforcing them. If a vulnerability allows an attacker to disable MFA before verification, then simply having MFA configured is not sufficient protection.
Organisations should therefore combine MFA with other controls such as network segmentation, restricted administrative access and least-privilege role assignments.
Security is strongest when several independent controls exist rather than relying entirely on one safeguard.
Veeam Agent For Linux Has A Privilege Escalation Flaw
Another high-severity vulnerability, CVE-2026-105477, affects Veeam Agent for Linux and has a CVSS score of 7.3. This issue allows a local attacker to gain elevated privileges on Linux systems managed through Veeam Backup & Replication.
Unlike CVE-2026-108142, this vulnerability requires local access first. However, once an attacker has gained a foothold on a Linux system, privilege escalation can allow them to move from a limited account to a much more powerful level of access.
That could potentially make it easier to disable security controls, access sensitive files or interfere with backup operations.
Local Privilege Escalation Still Matters
Privilege escalation vulnerabilities are sometimes underestimated because they do not normally provide the initial entry point into a system. In real-world attacks, however, gaining limited access is often only the first step.
Attackers routinely chain several vulnerabilities together. One weakness provides initial access, another elevates privileges and a third enables lateral movement or persistence.
Fixing CVE-2026-105477 therefore helps reduce the number of options available to an attacker who has already reached a managed Linux system.
Two Path Traversal Vulnerabilities Also Affect Backup & Replication
Veeam has also fixed two medium-severity path traversal vulnerabilities in Veeam Backup & Replication. These are tracked as CVE-2026-108140 and CVE-2026-108141, with both carrying a CVSS score of 5.9.
The vulnerabilities involve users with the Restore Operator role who control a backed-up NAS share. Under vulnerable conditions, those users may be able to write files to arbitrary locations on the backup server.
Although the severity is lower than the authorization bypass vulnerability, writing files outside the intended destination can create opportunities for further compromise depending on what locations are accessible.
Restore Operator Permissions Should Be Reviewed
The two path traversal flaws reinforce the importance of keeping the Restore Operator role tightly controlled. Users should only receive that permission when it is genuinely required for their job.
Broadly assigning restore privileges increases the number of accounts capable of interacting with sensitive backup workflows. If one of those accounts is compromised, the attacker inherits the same capabilities.
Reviewing role assignments should therefore be part of the remediation process rather than focusing exclusively on installing the software update.
Veeam Backup & Replication 13.1 Requires Version 13.1.2
For organisations running Veeam Backup & Replication 13.1, affected versions include:
The fixed release is:
This applies to both Windows-based deployments and the Veeam Software Appliance.
Administrators should verify the exact build number after upgrading to ensure that the fixed release is actually running.
Veeam Backup & Replication 13.0 Requires Version 13.0.3
For organisations remaining on the 13.0 branch, affected versions include:
The fixed version is:
Again, this applies to both Windows-based installations and the Veeam Software Appliance.
Organisations should follow the supported upgrade procedure rather than assuming an automatic update has already taken place.
Veeam Agent For Linux 13.1 Also Needs An Update
Affected Veeam Agent for Linux installations include:
The fixed version is:
Linux systems managed through Veeam should be included in the remediation inventory rather than focusing only on the central backup server.
Large environments can easily contain older agents that were missed during previous maintenance cycles.
Veeam ONE 13.1 Requires Patch 1
Affected Veeam ONE 13.1 versions include:
The fixed release is:
Because the vulnerability can affect MFA enforcement, organisations using Veeam ONE should treat this update seriously, particularly where the platform is integrated into broader monitoring and administrative workflows.
After updating, administrators should confirm that MFA remains enabled and operating as expected.
Several Older Product Branches Are Not Affected
Not every Veeam product or version is affected by this particular set of vulnerabilities. According to the advisory, the following are not impacted:
• Veeam Backup & Replication 12.x and earlier
• Veeam ONE 13.0.x and 12.x
• Veeam Agent for Linux 13.0.x and 6.x
This does not mean those older releases are free from other security concerns, but they are not listed as affected by the vulnerabilities covered in this advisory.
Administrators should still evaluate whether older versions remain supported and appropriate for production use.
No Workaround Has Been Provided
Veeam has released fixed versions for all affected products, but no workaround has been provided. That makes upgrading the primary remediation path.
Temporary compensating controls such as segmentation and restricted access can reduce exposure, but they do not remove the underlying vulnerability from the software.
Organisations should therefore avoid treating network controls as a permanent substitute for installing the update.
Do Not Expose Veeam Backup Servers Directly To The Internet
Backup servers should not be directly accessible from the public internet. There is rarely a legitimate reason for production backup infrastructure to accept arbitrary inbound connections from external networks.
If remote administration is required, access should occur through secure management networks, VPNs or other controlled mechanisms.
Reducing internet exposure can significantly lower the likelihood of attackers reaching the vulnerable service in the first place.
Restrict Access To Trusted Administrative Systems
Network access to backup infrastructure should be limited to authorised administrative systems only. A user workstation does not necessarily need direct access to the Veeam backup server simply because the user works for the organisation.
Firewalls and network segmentation can restrict management traffic to dedicated jump hosts, administrative networks or specific approved IP addresses.
This limits the number of systems from which an attacker can attempt to reach Veeam infrastructure after compromising an endpoint elsewhere in the environment.
Backup Networks Should Be Segmented
Backup systems ideally sit within their own protected network segment rather than sharing the same unrestricted access paths as ordinary servers and user devices.
This creates another barrier between ransomware operators and the recovery infrastructure they are likely to target.
Segmentation is especially important because attackers frequently move laterally through networks after gaining an initial foothold. The harder it is to reach the backup environment, the more difficult it becomes to destroy recovery data before deploying ransomware.
Immutable Backups Provide Another Layer Of Defence
Although not a substitute for patching, immutable backup storage can help protect recovery data from deletion or modification. A compromised backup server should not automatically mean every historical copy can be destroyed.
Organisations increasingly use object-locking, hardened repositories or other immutability mechanisms to ensure certain backup copies cannot be altered for a defined period.
This creates an additional recovery option even if attackers successfully compromise part of the backup infrastructure.
Offline Or Isolated Copies Are Still Valuable
Maintaining offline or otherwise isolated backup copies remains one of the strongest protections against ransomware. If an attacker cannot reach a particular copy from the production environment, destroying it becomes much harder.
Modern backup strategies often combine online recovery copies for speed with isolated or immutable copies for resilience.
The critical Veeam authorization bypass vulnerability is another reminder of why organisations should not depend on one single backup server or one single layer of protection.
Monitor Veeam Logs After Updating
After applying the fixed versions, administrators should review Veeam logs for unusual activity, particularly around the period before the update was installed.
Unexpected connections, configuration changes, unusual restore operations or unexplained administrative behaviour may warrant further investigation.
Although active exploitation has not been reported, checking for suspicious activity helps provide confidence that the environment was not compromised before remediation.
Patch The Backup Infrastructure Before Attackers Catch Up
The vulnerabilities were disclosed on 27 October 2026, and public details are now available. That means attackers can begin analysing the fixed versions and attempting to determine how the vulnerabilities work.
The longer an organisation remains unpatched, the more time adversaries have to reverse-engineer the changes.
This is particularly important for CVE-2026-108142 because an unauthenticated attacker only needs network access to the backup server rather than valid credentials.
Treat Backup Infrastructure As Critical Security Infrastructure
Backup servers should receive the same level of security attention as domain controllers, identity systems and perimeter firewalls. They are not simply storage appliances sitting quietly in the background.
During a major cyberattack, reliable backups may determine whether the organisation can recover quickly or faces prolonged disruption.
Security updates affecting backup systems should therefore receive accelerated review and deployment rather than waiting for a routine maintenance cycle.
Final Thoughts
The latest Veeam security release contains several vulnerabilities, but CVE-2026-108142 deserves immediate attention. The critical authorization bypass carries a CVSS score of 9.1 and could allow an unauthenticated attacker with network access to bypass authorization checks within the Continuous Data Protection Coordinator Service.
Veeam has also addressed CVE-2026-107671 in Veeam ONE, CVE-2026-105477 in Veeam Agent for Linux, and two medium-severity path traversal vulnerabilities, CVE-2026-108140 and CVE-2026-108141, affecting Veeam Backup & Replication.
The fixed releases are Veeam Backup & Replication 13.1.2, Veeam Backup & Replication 13.0.3, Veeam Agent for Linux 13.1.2 and Veeam ONE 13.1 P1. No workaround has been provided, making patching the primary solution.
There is currently no confirmed active exploitation and no public proof-of-concept, but that situation can change quickly once attackers analyse the security patches. Backup servers are already prime ransomware targets, so organisations should take advantage of the current window and update before exploitation becomes easier.
The safest approach is straightforward: patch the affected Veeam products, keep backup servers off the public internet, restrict access to trusted administrative systems, review Restore Operator permissions and ensure resilient backup copies remain isolated from the infrastructure they are protecting.
Comments 0