Veeam has published a fresh batch of security bulletins covering Backup & Replication 13, Veeam Backup for Microsoft 365, Veeam Agent for Linux and Veeam ONE, and two of the fixes are rated critical. The headliner, CVE-2026-108142 (CVSS v4.0 9.1), lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance. Close behind is CVE-2026-106076 (CVSS 9.0), a SQL injection in Backup for Microsoft 365 that can lead to cross-tenant configuration access and code execution. The bulletins went live on October 27, 2026, and Veeam says none of the bugs are known to be exploited yet. Backup servers are a favorite ransomware target, though, so here’s what was fixed, which builds you need, and why this belongs at the top of this week’s change list.
The Headliner: A CDP Coordinator Authorization Bypass
According to Veeam’s KB4948, CVE-2026-108142 affects Backup & Replication 13.1.1.18 and all earlier 13.1 builds, plus 13.0.2.29 and all earlier 13.0 builds. The CDP Coordinator handles Continuous Data Protection, Veeam’s near-real-time replication for VMware workloads, and the flaw can be reached over the network with no credentials and no user interaction. Veeam’s scoring rates the integrity and availability impact as high, both on the backup server itself and on downstream systems.
There is one piece of good news for shops that have not moved to version 13 yet: Veeam states plainly that older versions such as 12.x are not affected. The same bulletin also fixes two medium-severity path traversal bugs, CVE-2026-108140 and CVE-2026-108141 (CVSS 5.9 each), that let a user with the Restore Operator role who also controls a backed-up NAS share write files anywhere on the backup server, along with a high-severity local privilege escalation in Veeam Agent for Linux, CVE-2026-105477 (CVSS 7.3), that only hits agents managed by Backup & Replication.
Backup for Microsoft 365: A Cross-Tenant SQL Injection
MSPs running Veeam Backup for Microsoft 365 for client tenants should pay close attention to KB4957. Veeam describes CVE-2026-106076 as a flaw that lets “an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.” The bulletin covers four bugs in total:
- CVE-2026-106076 (Critical, 9.0): Organization-transfer SQL injection with cross-tenant impact, fixed in build 8.6.0.1102
- CVE-2026-106077 (High, 8.3): A Backup for Microsoft 365 Administrator can read arbitrary files on the server with LocalSystem privileges, fixed in 8.6.0.1102
- CVE-2026-106078 (Medium, 6.9): An unauthenticated attacker can bypass REST API authentication with a forged federation token, fixed only in 8.6 Patch 1
- CVE-2025-64394 (Medium, 4.3): A low-privileged local user can write files as SYSTEM during installation, also fixed only in 8.6 Patch 1
That split matters. As TechGeeks pointed out in its breakdown of the advisory, installing the base 8.6.0.1102 build alone leaves the REST authentication and installer issues open, so the real target is 8.6 Patch 1, build 8.6.0.5011. Veeam also notes that unsupported versions were not tested but “are likely affected and should be considered vulnerable.”
The Builds You Need
- Backup & Replication 13.1: Upgrade to 13.1.2 (build 13.1.2.57)
- Backup & Replication 13.0: Upgrade to 13.0.3 (build 13.0.3.63) or later
- Veeam Agent for Linux: Upgrade to 13.1.2 (build 13.1.2.11)
- Backup for Microsoft 365: Upgrade to 8.6 Patch 1 (build 8.6.0.5011)
- Veeam ONE: Install 13.1 Patch 1 (build 13.1.0.7940), which fixes CVE-2026-107671, a bug that lets someone who already holds valid Administrator credentials turn off MFA before completing MFA verification
Why IT Pros Should Move Fast
Veeam’s own bulletins spell out the risk: once a patch is disclosed, “attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments.” History backs that up. Ransomware crews have repeatedly gone after Backup & Replication flaws soon after disclosure, because wiping or encrypting backups is the fastest way to force a payout. A few practical steps for this week:
- Inventory every build: Check each Backup & Replication server, appliance, Backup for Microsoft 365 server and Veeam ONE instance you or your clients run, and note the exact build number.
- Prioritize CDP users and v13 servers: Any version 13 server, especially one using Continuous Data Protection, goes to the front of the line.
- Don’t stop at 8.6: For Backup for Microsoft 365, confirm the running build reads 8.6.0.5011 or later after the upgrade.
- Review roles: Audit who holds the Restore Operator and Backup for Microsoft 365 Administrator roles, and trim anything that is not needed.
- Keep backup infrastructure isolated: Backup servers should not be reachable from general user networks or the internet, and immutable or offline copies remain the last line of defense.
Looking Ahead
Veeam credits these reports to its HackerOne bug bounty program, and the steady flow of findings shows researchers are looking hard at backup platforms. With no exploitation reported so far, defenders have a head start, but that window has historically been short for Veeam bugs once patches can be diffed.
Watch CISA’s Known Exploited Vulnerabilities catalog and Veeam’s KB pages over the coming weeks. If either CVE-2026-108142 or CVE-2026-106076 starts showing up in attacks, unpatched backup servers will be some of the most valuable targets on the network, and the shops that upgraded this week will be glad they did.
Sources:
- Veeam KB4948, October 27, 2026
- Veeam KB4957, October 27, 2026
- Veeam KB4951, October 27, 2026
- TechGeeks, October 27, 2026
- pwn.watch, October 28, 2026
