Threat reportVulnerabilityTL-2026-4639
Veeam Backup & Replication Authorization Bypass (CVE-2026-108142) and Three Related Vulnerabilities Patched
Veeam Backup & Replication Authorization Bypass (TL-2026-4639) is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-28. It has no confirmed attribution, affects Veeam Backup & Replication, references 4 CVEs (CVE-2026-108142, CVE-2026-108140, CVE-2026-108141), maps to 4 MITRE ATT&CK techniques (T1078, T1190, T1485), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4639
- Threat ID
- TL-2026-4639
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors using veeam backup infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How Veeam Backup & Replication Authorization Bypass works
Veeam patched four vulnerabilities in Backup & Replication and Agent for Linux, led by CVE-2026-108142, a critical unauthenticated authorization bypass in the CDP Coordinator Service (CVSS v4.0 9.1). No active exploitation has been reported; all four issues were reported through HackerOne.
On 2026-10-27 Veeam published advisory KB4948 covering four vulnerabilities fixed in Veeam Backup & Replication 13.1.2 (build 13.1.2.57), 13.0.3 (build 13.0.3.63) and Veeam Agent for Linux 13.1.2 (build 13.1.2.11).
CVE-2026-108142 (CVSS v4.0 9.1, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H, NVD CWE-636) lets an unauthenticated network attacker bypass authorization checks on the CDP Coordinator Service. It affects Backup & Replication 13.1.1.18 and earlier and 13.0.2.29 and earlier, on both Windows deployments and the Veeam Software Appliance. Version 12.x is not affected. The advisory does not state that remote code execution is possible, and no exploit mechanics or proof of concept are published. The vector shows high integrity and availability impact on the backup server (VI:H/VA:H) and on subsequent systems (SI:H/SA:H), with no confidentiality impact (VC:N/SC:N).
CVE-2026-108140 and CVE-2026-108141 (CVSS v4.0 5.9 each, AV:N/AC:H/AT:P/PR:H) are relative path traversal flaws. An authenticated Restore Operator who controls the contents of a NAS share could write attacker-controlled files to an arbitrary path on the backup server. They affect the same Backup & Replication versions as CVE-2026-108142.
CVE-2026-105477 (CVSS v4.0 7.3, AV:L/AC:L/AT:P/PR:L) is a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier. It affects managed installations only and is fixed in 13.1.2.11.
The four issues were reported via HackerOne. The sources report no active exploitation and no public PoC, and CISA KEV listed none of these CVEs in the portion of the catalog that was read. The page was truncated, so this is not a full-catalog confirmation. Backup servers are high-value targets, so prompt patching is advised, but this is patch-priority intelligence rather than an active-threat report.
MITRE ATT&CK techniques used in TL-2026-4639
Defense Evasion
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Veeam Backup & Replication Authorization Bypass
Remediation for Veeam Backup & Replication Authorization Bypass
Patches
- Veeam KB4948: Backup & Replication 13.1.2.57 and 13.0.3.63; Agent for Linux 13.1.2.11
Immediate actions
- Upgrade Veeam Backup & Replication 13.1.x to 13.1.2 (build 13.1.2.57)
- Upgrade Veeam Backup & Replication 13.0.x to 13.0.3 (build 13.0.3.63)
- Upgrade Veeam Agent for Linux 13.1.x to 13.1.2 (build 13.1.2.11)
Longer-term hardening
- Keep backup servers on a restricted management network segment and do not expose the CDP Coordinator Service beyond required hosts
- Review Restore Operator role membership and NAS share content controls
- Monitor the backup server for unexpected file writes outside configured paths
CVEs associated with Veeam Backup & Replication Authorization Bypass
CVE-2026-108142, CVE-2026-108140, CVE-2026-108141, CVE-2026-105477
Weaknesses (CWE) in Veeam Backup & Replication Authorization Bypass
Timeline of Veeam Backup & Replication Authorization Bypass
- All four vulnerabilities credited to HackerOne reports; the dates of the original reports are not stated in the sources.
- NVD published CVE-2026-108142 (CVSS v4.0 9.1, CWE-636) referencing KB4948.
- Fixed builds released: Backup & Replication 13.1.2.57 and 13.0.3.63, and Agent for Linux 13.1.2.11.
- Veeam published advisory KB4948 covering CVE-2026-108142, CVE-2026-108140, CVE-2026-108141 and CVE-2026-105477.
- CISA KEV check performed: none of the four CVEs appeared in the portion of the catalog that was read (page truncated, not a full-catalog check).
- Cyber Security News reported the patches and stated that no active exploitation had been observed.
Sources cited for Veeam Backup & Replication Authorization Bypass
Detection coverage for TL-2026-4639
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4639 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.