Veeam published security bulletins on 27 October for three products at once, and the worst of them needs no credentials at all. CVE-2026-108142 lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service in Backup & Replication 13, scoring 9.1 under CVSS 4.0. The same batch fixes a critical SQL injection in Backup for Microsoft 365 and an MFA bypass in Veeam ONE.
What happened
Veeam shipped Veeam Backup & Replication 13.1.2 and 13.0.3, Veeam Backup for Microsoft 365 8.6 and 8.6 Patch 1, and Veeam ONE 13.1 Patch 1. Veeam assigned the flaws through its HackerOne disclosure programme and published the CVE records on the same day as the builds.
The headline bug is CVE-2026-108142, a CWE-636 failing-open defect in the CDP Coordinator Service. Veeam rates it critical at 9.1 because the attack vector is the network with no privileges and no user interaction required. Veeam's bulletin does not state that any of these flaws have been exploited in the wild.
Four more flaws came with the same Backup & Replication build: two path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140 and CVE-2026-108141, 5.9 each), and a local privilege escalation in Veeam Agent for Linux on installations managed by a backup server (CVE-2026-105477, 7.3).
In Veeam Backup for Microsoft 365 the worst is CVE-2026-106076 at 9.0: an authenticated organization-transfer peer can inject SQL into the source server's configuration database, giving cross-tenant read and write plus code execution as the PostgreSQL service account. Veeam ONE 13.1 carries an 8.5 MFA bypass (CVE-2026-107671) that an attacker holding Administrator credentials can use to switch MFA off globally before completing verification.
Who is affected
- Veeam Backup & Replication 13.1 up to and including 13.1.1.18, and 13.0 up to and including 13.0.2.29, on Windows-based servers and the Veeam Software Appliance. Version 12.x is not affected.
- Veeam Backup for Microsoft 365 8.x up to 8.5.0.1014 for the SQL injection, and up to 8.6.0.1102 for the REST API authentication bypass (CVE-2026-106078) and the installer file-write bug (CVE-2025-64394).
- Veeam ONE 13.1 up to 13.1.0.7233.
- Veeam Agent for Linux 13.1 up to 13.1.1.4, but only when the agent is managed by a Backup & Replication instance.
What to do now
Move Backup & Replication to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Backup for Microsoft 365 to 8.6 Patch 1 (build 8.6.0.5011), Veeam ONE to 13.1 Patch 1 (build 13.1.0.7940) and managed Linux agents to 13.1.2 (build 13.1.2.11).
- Confirm the build numbers in the console rather than trusting the updater's summary line.
- Check whether the backup server and its CDP components are reachable from outside the management VLAN, and close anything that is.
- Review who holds the Restore Operator role, since CVE-2026-108140 and CVE-2026-108141 need that role plus control of a NAS share.
- Verify you have an offline or immutable copy of the backup server's configuration backup before you upgrade.
- Treat Veeam ONE administrator accounts as tier-zero and audit them after patching, given the MFA bypass.
What this means for South African businesses
Backup infrastructure is the first thing a ransomware crew hunts, because killing recovery is how the extortion works. In South African mid-market environments Veeam usually runs as a single Windows server with the console reachable from the same flat network as staff laptops, which is precisely the deployment shape this flaw punishes. My read is that the realistic path here is not internet scanning but a foothold on any workstation that can reach the backup VLAN, and an SME with one backup server and no tested restore has no margin once that happens.
Source
The affected builds and fixed versions are in Veeam's KB4948 advisory for Backup & Replication.