Veeam fixes five flaws in backup and monitoring software

Veeam has published two security advisories on 27 October 2026 addressing five vulnerabilities across its Backup & Replication suite and Veeam ONE. The most severe is CVE-2026-108142, with a CVSS v4 score of 9.1, which allows an unauthenticated attacker to bypass authorisation on the CDP Coordinator Service across Windows and Veeam Software Appliance deployments.

The advisories note that all five flaws were reported via HackerOne and affect authentication, file restoration and local agent permissions, with the potential to enable MFA bypass and unauthorized service access if unpatched. The article states there is no public proof-of-concept and no confirmed active exploitation at the time of reporting.

The five CVEs are CVE-2026-108142 (critical), CVE-2026-107671 (high, CVSS 8.5), CVE-2026-105477 (7.3), and CVE-2026-108140 and CVE-2026-108141 (both 5.9). Affected versions are limited to Veeam 13 releases: CVE-2026-108142, CVE-2026-108140 and CVE-2026-108141 affect Veeam Backup & Replication 13.1.1[.]18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds; CVE-2026-105477 affects Veeam Agent for Linux 13.1.1.4 and earlier 13.1 builds; CVE-2026-107671 affects Veeam ONE 13.1.0.7233 and earlier 13.1 builds.

The article instructs applying updates: Backup & Replication to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63), Veeam Agent for Linux to 13.1.2 (build 13.1.2.11), and Veeam ONE to 13.1 P1 (build 13.1.0.7940). The piece attributes guidance to Veeam KB4948 and KB4951 and notes that enterprise backup servers remain targets for ransomware operators, though it does not report any confirmed exploitation.