Critical Veeam Backup flaw: update to 13.1.2 or 13.0.3
A critical flaw in Veeam Backup & Replication lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service. The fix is in 13.1.2 and 13.0.3.
If your company or a client backs up with Veeam Backup & Replication 13, there is a critical flaw that lets an attacker with no login bypass authorization on the server. Here is how to tell whether your version is affected, and which build fixes it.
What is the critical Veeam Backup & Replication flaw?
The critical Veeam Backup & Replication flaw lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service.
It is CVE-2026-108142, rated critical in Veeam's security bulletin: 9.1 on CVSS v4.0. The official Veeam bulletin is KB4948, and the flaw was reported through HackerOne.
A backup server holds copies of the data of every system it protects. So any way in without a login is worth an update the same day.
Who is affected?
The affected versions are the 13.1 and 13.0 branches of Veeam Backup & Replication. The bulletin says older versions, such as 12.x, are not affected.
Branch | Affected | Fix |
|---|---|---|
13.1 | 13.1.1.18 and all earlier 13.1 builds | 13.1.2 (build 13.1.2.57) |
13.0 | 13.0.2.29 and all earlier 13.0 builds | 13.0.3 (build 13.0.3.63) |
12.x | Not affected | No update needed for this flaw |
If you run other servers yourself, we wrote earlier about the GitLab flaw that runs code without a login.
What else is in the same bulletin?
The same bulletin has three more flaws, one of them in another product:
CVE-2026-108140 and CVE-2026-108141: rated medium, 5.9 each. A user with the Restore Operator role who controls the contents of a backed-up NAS share can write files to an arbitrary path on the server. The same versions are affected, and the same builds fix them.
CVE-2026-105477: rated high, 7.3, a local privilege escalation in Veeam Agent for Linux. Affected are 13.1.1.4 and all earlier 13.1 builds, and the fix is 13.1.2 (build 13.1.2.11). Versions 13.0.x and 6.x are not affected, and the bulletin says only installations managed by Veeam Backup & Replication are affected.
How do you fix it?
Update Veeam Backup & Replication to 13.1.2 (build 13.1.2.57) if you are on the 13.1 branch, or to 13.0.3 (build 13.0.3.63) if you are on the 13.0 branch.
Compare your build number with the table above, not just the version: the difference between affected and fixed shows in the build.
If you run Veeam Agent for Linux on the 13.1 branch, update it too, to 13.1.2 (build 13.1.2.11).
Where do you start now?
Start with your build number.
Open your Veeam Backup & Replication server, find the build number, and compare it with the table.
If it is 13.1.1.18 or earlier, or 13.0.2.29 or earlier, update to the fixed release on the same branch.
Check whether you run Veeam Agent for Linux on your Linux machines, and update it if it is on the 13.1 branch.
If you want someone to test your servers and the services open on them the way an attacker would, that is what Muhassan does.
All the security updates we have written about are in one place: Security updates.
FAQ
I run Veeam Backup & Replication 12. Do I need to update?
Not for this flaw. The Veeam bulletin says older versions such as 12.x are not affected, and only the 13.1 and 13.0 branches are.
Does the attacker need an account on the server?
No. According to the bulletin, the flaw lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service.
I also run Veeam Agent for Linux. Is it affected?
If it is 13.1.1.4 or an earlier 13.1 build and managed by Veeam Backup & Replication, yes, by a separate flaw in the same bulletin. The fix is in 13.1.2 (build 13.1.2.11), and versions 13.0.x and 6.x are not affected.
