Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability

What happened?

Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service. Tracked as CVE-2026-108142, the flaw carries a CVSS v4.0 score of 9.1 and affects both Windows-based deployments and the Veeam Software Appliance. The company disclosed the issue on October 27, 2026, in its security advisory KB4948.

Key details

• Unauthenticated attacker can bypass authorization checks on CDP Coordinator Service.
• Fixed releases are Backup & Replication 13.1.2 build 13.1.2.57 and 13.0.3 build 13.0.3.63.
• CVE-2026-105477 is a high-severity local privilege escalation affecting Veeam Agent for Linux.
• CVE-2026-105477 affected releases include 13.1.1.4 and earlier 13.1 builds.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.