Veeam vulnerability CVE-2026-108142: check and patch your backup server
On October 27, 2026, Veeam published a security bulletin for Veeam Backup & Replication 13. The main flaw, CVE-2026-108142, is rated 9.1 out of 10 (critical): an attacker without an account can bypass the authorization checks of a backup server service, the CDP Coordinator Service. The fix is already out: version 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63).
Many small businesses use Veeam without really knowing it: the IT provider installed it, and nobody looks at the version as long as the reports are green. This article helps you check in ten minutes whether the Veeam vulnerability affects your server, and ask the right questions.
Veeam vulnerability CVE-2026-108142: what was announced
According to Veeam’s KB4948 bulletin, the flaw affects Windows-based Veeam Backup & Replication and the Veeam Software Appliance, on versions 13.1 up to 13.1.1.18 and 13.0 up to 13.0.2.29. Versions 12.x are not affected by this specific flaw. It was reported through Veeam’s HackerOne program.
Based on the published CVSS score, the impact is mainly on the server’s integrity and availability: in plain terms, what it does and whether it keeps running. The bulletin doesn’t mention active exploitation. Veeam does point out, in every bulletin, that once a patch is published, attackers try to analyze it to target servers that haven’t been updated.
The same bulletin fixes two medium flaws (CVE-2026-108140 and CVE-2026-108141), which require an account with the Restore Operator role, as well as a privilege escalation in Veeam Agent for Linux 13.1 (CVE-2026-105477) when the agent is managed by Veeam Backup & Replication.
Your backup server card
Before talking about patches, you need to know what you have. Here is the card we fill in with our clients. Print it or paste it into an email to your provider.
Which version fixes what
October was busy at Veeam: a critical flaw in version 12 on October 6, then this one in version 13 on October 27, plus fixes for Veeam Backup for Microsoft 365. This table sums up the builds to aim for, based on Veeam’s bulletins.
| Installed branch | Affected builds | Fixed starting in |
|---|---|---|
| Veeam Backup & Replication 13.1 | 13.1.1.18 and all earlier 13.1 builds | 13.1.2 (build 13.1.2.57) |
| Veeam Backup & Replication 13.0 | 13.0.2.29 and all earlier 13.0 builds | 13.0.3 (build 13.0.3.63) |
| Veeam Backup & Replication 12.x | Not affected by CVE-2026-108142 | But see the October 6 flaw: 12.3.2 P4 (build 12.3.2.4934) |
| Veeam Agent for Linux 13.1 (managed by VBR) | 13.1.1.4 and earlier 13.1 builds (CVE-2026-105477) | 13.1.2 (build 13.1.2.11) |
| Veeam Backup for Microsoft 365 | 8.6.0.1102 and earlier version 8 builds (depending on the flaw) | 8.6 Patch 1 (build 8.6.0.5011) |
If you’re on version 12: CVE-2025-64393 (9.4, critical), fixed in 12.3.2 P4, let an account with the basic Backup Viewer role run code on the server. The Canadian Centre for Cyber Security and Quebec’s Government Cyberdefence Centre both issued advisories about it. Veeam also notes that version 12 reaches end of support on February 28, 2027: a good time to plan the move to 13.
Four questions to see if you’re affected
🧭 Is your server affected?
Why the backup server is a prime target
A ransomware group wants two things: to encrypt your data and to stop you from restoring it. The backup server gives it both. Earlier Veeam Backup & Replication flaws, such as CVE-2024-40711, were exploited by ransomware groups after they were disclosed. We also saw it with the AhsayCBS flaw and with the ransomware that targeted IDCF Cloud backups.
The update fixes today’s Veeam vulnerability. The four layers below handle the next one, the one that hasn’t been published yet.
Four layers around a backup server
Layer 1 · Network
The Veeam server sits in its own segment, reachable only from a few admin machines. No port open to the Internet.
Layer 2 · Accounts
Veeam accounts separate from domain Windows accounts, multifactor authentication and limited roles (a Restore Operator doesn’t need to be an administrator).
Layer 3 · Isolated copy
At least one immutable or offline copy that the server can’t erase, even if it’s taken hostage.
Layer 4 · Tested restore
A real restore test on a fixed schedule, with the time measured. It’s the only proof the rest works.
Our backup and disaster recovery page explains how we build these layers for a small business, and our server management includes tracking updates for software like Veeam.
Updating without breaking your backups
A few simple habits for a smooth update:
- Pick a time outside scheduled jobs: the update stops Veeam services for a few minutes.
- Back up the Veeam configuration (the Configuration Backup feature) before you start.
- Update related components: agents and proxy servers follow the console.
- Run a manual job afterwards and check that it finishes without errors.
- Write down the new build number on your card, with the date.
Keeping a backup server up to date also means knowing when a job fails or when someone logs in at 3 a.m. Our cybersecurity services include an inventory of your backup software and versions, and our automated 24/7 monitoring with on-call technician intervention flags unusual logins and stopped services on monitored servers.
Book your free cyber check
Not sure which Veeam version you run, or whether your backup server can be reached from the Internet? The free cyber check reviews your backups, their isolation and the patches to apply first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Veeam, KB4948 : Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 (October 27, 2026)
- Veeam, KB4957 : Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
- Veeam, KB4934 : Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 (October 6, 2026)
- Canadian Centre for Cyber Security, advisory AV26-1009
- Quebec Government Cyberdefence Centre, CERTQC-AVIS-2026-375 (in French)
- Rapid7, entry for CVE-2026-108142
Photo: Marta Branco, Pexels (Pexels licence).