# Veeam Backup & Replication Authorization Bypass (CVE-2026-108142) and Three Related Vulnerabilities Patched

> Veeam patched four vulnerabilities in Backup & Replication and Agent for Linux, led by CVE-2026-108142, a critical unauthenticated authorization bypass in the CDP Coordinator Service (CVSS v4.0 9.1). No active exploitation has been reported; all four issues were reported through HackerOne.

- **Published:** 2026-10-28T12:01:16Z
- **Last reviewed:** 2026-10-28T12:01:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4639
- **ID:** TL-2026-4639
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-108142, CVE-2026-108140, CVE-2026-108141, CVE-2026-105477

## Description

On 2026-10-27 Veeam published advisory KB4948 covering four vulnerabilities fixed in Veeam Backup & Replication 13.1.2 (build 13.1.2.57), 13.0.3 (build 13.0.3.63) and Veeam Agent for Linux 13.1.2 (build 13.1.2.11).

CVE-2026-108142 (CVSS v4.0 9.1, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H, NVD CWE-636) lets an unauthenticated network attacker bypass authorization checks on the CDP Coordinator Service. It affects Backup & Replication 13.1.1.18 and earlier and 13.0.2.29 and earlier, on both Windows deployments and the Veeam Software Appliance. Version 12.x is not affected. The advisory does not state that remote code execution is possible, and no exploit mechanics or proof of concept are published. The vector shows high integrity and availability impact on the backup server (VI:H/VA:H) and on subsequent systems (SI:H/SA:H), with no confidentiality impact (VC:N/SC:N).

CVE-2026-108140 and CVE-2026-108141 (CVSS v4.0 5.9 each, AV:N/AC:H/AT:P/PR:H) are relative path traversal flaws. An authenticated Restore Operator who controls the contents of a NAS share could write attacker-controlled files to an arbitrary path on the backup server. They affect the same Backup & Replication versions as CVE-2026-108142.

CVE-2026-105477 (CVSS v4.0 7.3, AV:L/AC:L/AT:P/PR:L) is a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier. It affects managed installations only and is fixed in 13.1.2.11.

The four issues were reported via HackerOne. The sources report no active exploitation and no public PoC, and CISA KEV listed none of these CVEs in the portion of the catalog that was read. The page was truncated, so this is not a full-catalog confirmation. Backup servers are high-value targets, so prompt patching is advised, but this is patch-priority intelligence rather than an active-threat report.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1565 Data Manipulation
- T1485 Data Destruction

## Sources

- [Veeam KB4948: Vulnerabilities in Veeam Backup & Replication 13.1.2](https://www.veeam.com/kb4948)
- [Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability](https://cybersecuritynews.com/veeam-patches-authorization-bypass-vulnerability/)
- [NVD: CVE-2026-108142](https://nvd.nist.gov/vuln/detail/CVE-2026-108142)
- [NVD: CVE-2026-108140](https://nvd.nist.gov/vuln/detail/CVE-2026-108140)
- [NVD: CVE-2026-108141](https://nvd.nist.gov/vuln/detail/CVE-2026-108141)
- [NVD: CVE-2026-105477](https://nvd.nist.gov/vuln/detail/CVE-2026-105477)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4639