Veeam has released security fixes for a critical authorisation bypass in its Backup & Replication software that could let an attacker without login credentials bypass access checks on the product's Continuous Data Protection (CDP) Coordinator Service. The flaw, tracked as CVE-2026-108142, carries a CVSS v4.0 score of 9.1 out of 10 and affects both Windows-based deployments and the Veeam Software Appliance. The company disclosed the issue on 27 October 2026 in security advisory KB4948. It also covers two medium file-write flaws and a high-severity Linux agent flaw, all reported via HackerOne. Fixed releases are 13.1.2 and 13.0.3; version 12.x is unaffected.

Why backup servers are a priority target

Backup systems hold the keys to recovery after a ransomware attack, which is exactly why they attract attackers. If a backup server can be compromised, criminals can delete or corrupt the copies an organisation would rely on to restore its systems, leaving it with little choice but to pay a ransom or rebuild from scratch.

What administrators should do now

Veeam's advisory does not describe an attack sequence, does not state that the flaw enables remote code execution, and does not report active exploitation, and no public proof-of-concept exploit has been confirmed. Researchers warn the window between a patch release and a working exploit can be short, as attackers reverse-engineer fixes.

Administrators should first confirm which version they are running, then move affected 13.x deployments to the fixed builds and update managed agents as part of the same programme. Where patching must wait, keep backup servers off the public internet, restrict access to trusted admin systems, and keep one backup copy isolated from protected infrastructure. Organisations should also check for unusual CDP Coordinator activity and trim restore-operator permissions. Once a flaw and its patch are public, attackers try to reverse-engineer the patch, so an unpatched backup platform undermines the recovery plan it exists to provide.

Sources: Veeam (advisory KB4948) and GBHackers.