In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, Veeam KB4948, "Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2" (published Oct 27, 2026), checked .

CVE
CVE-2026-108142
Exploited?
No exploitation reported. Veeam's KB4948 doesn't mention any attacks, and the flaw wasn't in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.28) at our check. Veeam warns that attackers will likely try to reverse-engineer the patch.

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
Veeam Backup & Replication 13.1 (Windows-based and Veeam Software Appliance)13.1.1.18 and all earlier 13.1 builds13.1.2 (build 13.1.2.57)Veeam KB4948, checked
Veeam Backup & Replication 13.0 (Windows-based and Veeam Software Appliance)13.0.2.29 and all earlier 13.0 builds13.0.3 (build 13.0.3.63)Veeam KB4948, checked

Patch checklist

  1. Check the build number of your Backup & Replication server. Veeam says older versions such as 12.x aren't hit by this flaw.
  2. Veeam's advice: install 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63).
  3. If you use Veeam Agent for Linux managed by Backup & Replication, update it to 13.1.2 (build 13.1.2.11); the same KB fixes a separate agent flaw, CVE-2026-105477.
  4. If an MSP runs your backups, ask them to confirm the build number.

If you can't update yet

  • Our advice: Veeam lists no workaround, so limit network access to the backup server to your admin network until you can update.

How to check for compromise

  • Our advice: review the backup server for accounts, jobs or settings changes you didn't make, and confirm recent restore points are intact.

Full steps and context: What to do now

TL;DR: Veeam fixed CVE-2026-108142, a Critical flaw in Veeam Backup & Replication 13 that lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service. Veeam scores it 9.1 (CVSS v4.0). No exploitation reported as of our check. Update 13.1 to build 13.1.2.57 and 13.0 to build 13.0.3.63.

What happened

The flaw: Veeam’s KB4948, published October 27, 2026, describes CVE-2026-108142 as “a vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.” It applies to Windows-based Backup & Replication and the Veeam Software Appliance, and was reported through HackerOne.

Who is affected: Veeam Backup & Replication 13.1.1.18 and all earlier 13.1 builds, and 13.0.2.29 and all earlier 13.0 builds. Veeam says older versions such as 12.x aren’t affected.

The fix: 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). The same update fixes two Medium-rated path traversal flaws (CVE-2026-108140 and CVE-2026-108141), and Veeam Agent for Linux 13.1.2 (build 13.1.2.11) fixes a High-rated local privilege escalation, CVE-2026-105477.

Exploitation: No exploitation reported. Veeam doesn’t mention attacks, and CISA’s catalog of exploited flaws (version 2026.10.28) doesn’t list it.

Why it matters

Backup servers are a favorite ransomware target, because an attacker who controls them can delete the copies you’d need to recover. Veeam warns that once a patch is out, attackers will likely reverse-engineer it. Our Security hub tracks other patches worth doing now.

What to do now

  1. Check your build number on each Backup & Replication server.
  2. Update 13.1 to 13.1.2.57 or 13.0 to 13.0.3.63. Update managed Veeam Agent for Linux installs to 13.1.2.11.
  3. Until then, our advice is to keep the backup server reachable only from your admin network.

Updates

  • Oct 29, 2026, 1:20 p.m. Manila: First published.

Sources & method

Sources

Method. Checked October 29, 2026, at 12:45 p.m. Manila time (04:45 UTC). The affected and fixed builds, severity, score and description come from Veeam’s KB4948. We checked the CVE record, NVD and the KEV catalog (version 2026.10.28) for the CVE. Steps labelled “our advice” are our own judgment, not Veeam’s. The thumbnail is the preview image of Veeam’s KB4948. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.