Backup servers hold the keys to recovery, which is exactly why ransomware crews go after them first. On October 27, 2026, Veeam published security bulletins for Backup & Replication 13, Veeam Backup for Microsoft 365, and Veeam ONE, including two critical flaws that administrators should treat as urgent.
CVE-2026-108142: unauthenticated CDP Coordinator bypass
The most severe bug, CVE-2026-108142 (CVSS 4.0 score 9.1), lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service (the component behind Continuous Data Protection) on:
- Windows-based Backup & Replication servers, and
- the Veeam Software Appliance.
Affected builds are 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds. The 12.x line is not affected.
The same bulletin fixes:
- CVE-2026-108140 and CVE-2026-108141 (medium): path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server.
- CVE-2026-105477 (high): local privilege escalation in Veeam Agent for Linux when managed by Backup & Replication.
CVE-2026-106076: cross-tenant SQL injection in Backup for Microsoft 365
In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server’s configuration database. The result is cross-tenant read and write of configuration data and code execution as the PostgreSQL service account. It is rated 9.0 (critical).
The Microsoft 365 bulletin also covers:
- CVE-2026-106077: arbitrary file reads by an Administrator.
- CVE-2026-106078: an unauthenticated REST API authentication bypass using a forged federation token.
- CVE-2025-64394: an installer file-write bug.
For service providers running multi-tenant Microsoft 365 backup, the cross-tenant angle is the scariest part: one compromised peer could reach other customers’ configuration.
Veeam ONE MFA bypass
Veeam ONE 13.1 Patch 1 fixes CVE-2026-107671, an MFA bypass that only helps an attacker who already holds Administrator credentials.
Is it being exploited?
Veeam’s bulletins don’t mention exploitation in the wild. History is the reason to move fast anyway: Backup & Replication vulnerabilities have repeatedly been picked up by ransomware groups shortly after disclosure, because wiping or encrypting backups removes a victim’s easiest way to recover.
What to do now
- Upgrade Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63).
- Upgrade Veeam Agent for Linux to 13.1.2.
- Upgrade Veeam Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011).
- Upgrade Veeam ONE to 13.1 P1 (13.1.0.7940).
- Keep backup servers off the general corporate network and restrict access to CDP and management ports to the hosts that actually need them.
- Review recent logins and job changes on backup infrastructure, and make sure at least one copy of your backups is immutable or offline.
