Veeam Patches Critical Unauthenticated Authorization Bypass in Backup & Replication 13 (CVE-2026-108142)

Scope: Veeam Backup & Replication 13.1.1.18 and earlier (13.1 branch), 13.0.2.29 and earlier (13.0 branch), both Windows deployments and the Veeam Software Appliance

Severity: Red

Veeam published security advisory KB4948 on October 27, 2026, alongside Backup & Replication 13.1.2, addressing CVE-2026-108142, a critical authorization bypass rated 9.1 on CVSS v4.0 in the CDP Coordinator Service. The flaw allows a completely unauthenticated attacker with network access to bypass authorization checks entirely, requiring no privileges and no user interaction. No active exploitation has been confirmed as of this writing, and the vulnerability does not yet appear in CISA’s Known Exploited Vulnerabilities catalog, but Veeam’s own advisory carries its standard caution that attackers routinely reverse-engineer disclosed patches to build working exploits. Backup infrastructure is a consistently high-value target precisely because compromising it can let an attacker destroy recovery options before deploying ransomware elsewhere in an environment, a pattern seen repeatedly with earlier Veeam vulnerabilities. The same release also fixed two medium-severity path traversal flaws (CVE-2026-108140 and CVE-2026-108141), and a separate advisory, KB4951, addressed CVE-2026-107671, a high-severity MFA bypass in Veeam ONE rated 8.5. A fourth flaw, CVE-2026-105477, is a high-severity local privilege escalation in Veeam Agent for Linux when managed by Backup & Replication. Organisations running Veeam Backup & Replication must update to version 13.1.2 or 13.0.3 today, apply the Veeam ONE patch for the MFA bypass separately, and update any managed Linux agents to close the privilege escalation path.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.