CVE-2026-108140: CVE-2026-108140 (Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142))
October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.
Executive Summary & Technical Impact
October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.
Tracked under CVE-2026-108140 (CWE-Other (Security Advisory)), this vulnerability affects Backup & Replication 13.1.1.18 and earlier 13.1 builds, 13.0.2.29 and earlier 13.0 builds (12.x not affected); Backup for Microsoft 365 before 8.6 P1 and carries a severity score of 9.1 (CRITICAL). Engineering and security operations teams running Veeam Infrastructure should prioritize upgrading to Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63); Agent for Linux 13.1.2; Backup for Microsoft 365 8.6 P1 (8.6.0.5011); Veeam ONE 13.1 P1 (13.1.0.7940).
Remediation & Patch Guidance
- CVE-2026-108142 (CVSS 4.0 9.1) lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication 13 servers and the Veeam Software Appliance.
- CVE-2026-106076 (CVSS 9.0) is an SQL injection in Veeam Backup for Microsoft 365 that can lead to cross-tenant configuration access and code execution as the PostgreSQL service account.
- Veeam does not report exploitation, but Backup & Replication bugs have repeatedly been weaponized by ransomware gangs soon after disclosure.
- Upgrade to Backup & Replication 13.1.2 or 13.0.3, Backup for Microsoft 365 8.6 P1, Agent for Linux 13.1.2, and Veeam ONE 13.1 P1.
Frequently Asked Questions (CVE-2026-108140)
What versions are affected by CVE-2026-108140?
CVE-2026-108140 affects Backup & Replication 13.1.1.18 and earlier 13.1 builds, 13.0.2.29 and earlier 13.0 builds (12.x not affected); Backup for Microsoft 365 before 8.6 P1 in Veeam Infrastructure (CVE-2026-108140 (Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142))).
How do I patch or remediate CVE-2026-108140?
Upgrade affected deployments to Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63); Agent for Linux 13.1.2; Backup for Microsoft 365 8.6 P1 (8.6.0.5011); Veeam ONE 13.1 P1 (13.1.0.7940) and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-108140?
CVE-2026-108140 is rated CRITICAL with a CVSS score of 9.1 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142)
October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.
Read full engineering post-mortem (5 min read) →