Veeam has patched a CVSS 9.1 authorization bypass in Backup & Replication 13. If the backup server falls, a company loses its only way back from a ransomware attack.
On 27 October 2026 Veeam shipped updates closing five separate security flaws in Backup & Replication, the most widely deployed enterprise backup product, and in its monitoring companion Veeam ONE. The headline item is CVE-2026-108142, rated 9.1 on the CVSS v4.0 scale.
The flaw sits in the CDP Coordinator Service component of Veeam Backup & Replication 13. It lets an unauthenticated remote attacker bypass authorization checks altogether. It is classified as CWE-636, "not failing securely" — when the check fails, the component leaves access open instead of closing it. Veeam did not publish the underlying defect or any exploitation steps in advisory KB4948.
Which versions are affected
Affected builds are Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds. Both Windows-based deployments and the Veeam Software Appliance are in scope. The 12.x line is not affected. Fixes arrived in 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).
The rest of the batch deserves attention too. In Veeam ONE, CVE-2026-107671 (CVSS 8.5) allows someone holding valid administrator credentials to switch off multi-factor authentication system-wide; the fix is 13.1 P1 (build 13.1.0.7940). CVE-2026-105477 (CVSS 7.3) in Veeam Agent for Linux permits local privilege escalation, and CVE-2026-108140 and CVE-2026-108141 (both CVSS 5.9) let a user with Restore Operator rights write arbitrary files through an attacker-controlled NAS share.
Why this one deserves priority
According to the sources, there is no known active exploitation and no public exploit code for these flaws at the moment, and CVE-2026-108142 has not been added to CISA's catalogue of exploited vulnerabilities. The case for prioritising it anyway is straightforward: the target is the backup infrastructure itself.
Ransomware crews have spent years making sure backups are disabled before encryption begins. Once the backup server falls, an organisation has no path back — and by design that server already holds credentials and reach into every virtual machine and file server it protects. An authorization bypass on a backup host is therefore not one more server flaw; it is a key to the whole network.
In Türkiye this intersects with data protection duties. If a company processing personal data loses control of its backup infrastructure, that can be assessed under Article 12 of Law No. 6698 as a failure to take adequate data security measures, and it triggers the breach notification obligation. In smaller companies the backup server typically runs on a single physical box, inside the office LAN, often with no patching schedule at all — which widens the exposure considerably.
What we recommend at Kamer Bilişim
- Inventory your version today and patch if you are on 13.x. Check the build number in the Backup & Replication console. On 13.1, move to 13.1.2.57; on 13.0, move to 13.0.3.63. If you are still on 12.x, no emergency action is needed for this flaw, but review your support timeline regardless.
- Isolate the backup server at the network layer. Restrict access to management and CDP service ports to specific administrator addresses, ideally over a separate management VLAN. These components should never be reachable from the internet or from the full office network.
- Keep one immutable copy and test the restore. Hold at least one copy on a target that cannot be deleted or that does not accept office credentials, and run a real restore test every quarter. What matters is not that a backup exists but that you can come back from it.
If you would like your backup estate reviewed for version status, network isolation and realistic recovery times, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: SecurityOnline, SOC Prime, Veeam KB4948
Source: SecurityOnline