Veeam Patches Critical CVE-2026-108142 Authorization Bypass

Summary

Veeam’s CVE-2026-108142 is a critical, unauthenticated authorization bypass in Backup & Replication 13’s CDP Coordinator Service. Fixed builds are available; the vendor has not detailed the exploit path, and no public PoC or active exploitation was reported.

Key points

• CVE-2026-108142 affects the CDP Coordinator Service in Veeam Backup & Replication 13 and allows an unauthenticated remote attacker to bypass authorization.
• Veeam rates the flaw CVSS v4.0 9.1. Its vector indicates network access, no privileges, and no user interaction, but also lists additional attack requirements that the vendor has not explained.
• Affected builds include 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds. The article says Veeam 12.x is not affected.
• Veeam fixed the issue in version 13.1.2 build 13.1.2.57 and version 13.0.3 build 13.0.3.63.
• The vendor has not disclosed the exploitation sequence or claimed that the flaw enables remote code execution. The article reports no public PoC or active exploitation.
• Until patched, administrators are advised to restrict network access to backup infrastructure and monitor service activity, configuration changes, and administrative actions.

CVE

Vendors

Products

Related Articles

• Adobe, Veeam and Juniper Patch More Than Three Dozen Vulnerabilitiessecurityweek.comVeeam Agent for Linux
• Red Canary’s 2026 Threat Detection Report Highlights Surge in Identity Threat Detectionsgithub.com/jacobdjwilsonVeeam Backup & Replication
• Symantec Report Tracks Rising Encryptionless Extortion and New Ransomware Actorsgithub.com/jacobdjwilsonVeeam Backup & Replication
• Recorded Future Reports 34% Rise in Actively Exploited CVEs in H1 2026github.com/jacobdjwilsonVeeam Backup & Replication
• H1 2026 Threat Report Finds Rising CVE Exploitation and Continued Abuse of Trusted Toolsrecordedfuture.comVeeam Backup & Replication