What is the CVSS score and severity of CVE-2026-108142?

CVE-2026-108142 is rated CRITICAL with a CVSS score of 9.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) and is classified under CWE-287 (Improper Authentication / Authorization Bypass).

CVE-2026-108142 CRITICAL · CVSS 9.1 · Veeam — Veeam Backup & Replication 13 · 2026-10-28

CVE-2026-108142: Veeam Backup & Replication 13 CDP Coordinator Service

Q: What versions are affected by CVE-2026-108142?

CVE-2026-108142 affects Veeam Backup & Replication 13.1 <= 13.1.1.18, 13.0 <= 13.0.2.29, and Veeam Software Appliance (12.x not affected) in Veeam Backup & Replication 13 (Veeam Backup & Replication 13 CDP Coordinator Service).

Q: How do I patch or remediate CVE-2026-108142?

To remediate CVE-2026-108142, upgrade to the patched release: Veeam Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63). Upgrade Veeam Backup & Replication 13 immediately to build 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63). Isolate backup management interfaces and CDP Coordinator Service ports from general corporate VLANs using strict host firewall rules. Verify that offline or immutable backup repositories (hardened Linux repositories or object-locked cloud buckets) are active and untampered.

An unauthenticated authorization bypass in the Continuous Data Protection (CDP) Coordinator Service of Veeam Backup & Replication 13 allows remote attackers on the network to bypass authentication checks on Windows-based B&R 13 servers and the Veeam Software Appliance.

Identifier

CVE-2026-108142

Vendor / Product

Veeam · Veeam Backup & Replication 13

Severity / CVSS

CRITICAL · CVSS 9.1

Vector / CWE

CWE-287 (Improper Authentication / Authorization Bypass)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H

Affected

Veeam Backup & Replication 13.1 <= 13.1.1.18, 13.0 <= 13.0.2.29, and Veeam Software Appliance (12.x not affected)

Patched Version

Veeam Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63)

Priority

P0 — Patch Backup Servers Immediately (High Ransomware Risk)

Executive Summary & Technical Impact

Tracked under CVE-2026-108142 (CWE-287 (Improper Authentication / Authorization Bypass)), this vulnerability affects Veeam Backup & Replication 13.1 <= 13.1.1.18, 13.0 <= 13.0.2.29, and Veeam Software Appliance (12.x not affected) and carries a severity score of 9.1 (CRITICAL). Engineering and security operations teams running Veeam Backup & Replication 13 should prioritize upgrading to Veeam Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63).

Remediation & Patch Guidance

Upgrade Veeam Backup & Replication 13 immediately to build 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63).
Isolate backup management interfaces and CDP Coordinator Service ports from general corporate VLANs using strict host firewall rules.
Verify that offline or immutable backup repositories (hardened Linux repositories or object-locked cloud buckets) are active and untampered.

Frequently Asked Questions (CVE-2026-108142)

What versions are affected by CVE-2026-108142?

CVE-2026-108142 affects Veeam Backup & Replication 13.1 <= 13.1.1.18, 13.0 <= 13.0.2.29, and Veeam Software Appliance (12.x not affected) in Veeam Backup & Replication 13 (Veeam Backup & Replication 13 CDP Coordinator Service).

How do I patch or remediate CVE-2026-108142?

Upgrade affected deployments to Veeam Backup & Replication 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63) and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-108142?

CVE-2026-108142 is rated CRITICAL with a CVSS score of 9.1 (vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H).

Full TechPulse Investigation

Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142)

October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.

Read full engineering post-mortem (5 min read) →