I’M UNDER A CYBER ATTACK

Alert

Alert 2026-126 Critical vulnerabilities in Veeam Backup & Replication and other Veeam products

Affected product(s): 

ProductAffected versions
Veeam Backup & Replication 13.1 (Windows and Veeam Software Appliance)13.1.1.18 and all earlier builds of 13.1
Veeam Backup & Replication 13.0 (Windows and Veeam Software Appliance)13.0.2.29 and all earlier builds of 13.0
Veeam Agent for Linux 13.1 (installations managed by Veeam Backup & Replication)13.1.1.4 and all earlier builds of 13.1
Veeam Backup for Microsoft 365 v88.5.0.1014 and earlier (CVE-2026-106076 and CVE-2026-106077); 8.6.0.1102 and earlier (CVE-2026-106078 and CVE-2025-64394)
Veeam ONE 13.113.1.0.7233 and all earlier builds of 13.1

Veeam Backup & Replication 12.x, Veeam Agent for Linux 13.0.x and 6.x, and Veeam ONE 13.0.x and 12.x are not affected.

Description

Several vulnerabilities have been disclosed in Veeam products, two of which are critical: CVE-2026-108142 in Veeam Backup & Replication (CVSS v4.0 9.1) and CVE-2026-106076 in Veeam Backup for Microsoft 365 (CVSS v4.0 9.0). The vendor advisory does not mention active exploitation of any of them.

Veeam Backup & Replication 13.x

CVE-2026-108142 (CVSS v4.0 9.1 – critical) allows an unauthenticated remote attacker to bypass authorization in the CDP Coordinator service. It affects Veeam Backup & Replication running on Windows and Veeam Software Appliance installations in the 13.1 and 13.0 branches.

CVE-2026-108140 and CVE-2026-108141 (CVSS v4.0 5.9 – medium) allow attacker-controlled files to be written to an arbitrary path on the backup server through relative path traversal. Exploitation requires an authenticated user with the Restore Operator role who also controls the content of a backed-up NAS share.

Veeam Agent for Linux 13.1

CVE-2026-105477 (CVSS v4.0 7.3 – high) allows local privilege escalation. It only affects installations managed by a Veeam Backup & Replication instance.

Veeam Backup for Microsoft 365 v8

CVE-2026-106076 (CVSS v4.0 9.0 – critical) allows an authenticated organization-transfer peer to inject SQL into the configuration database of the source server, enabling configuration data to be read and written across tenants and enabling remote code execution as the PostgreSQL service account.

In addition, the vendor fixed CVE-2026-106077 (CVSS v4.0 8.3 – high), which allows a user with the Administrator role to read arbitrary files from the backup server with LocalSystem privileges; CVE-2026-106078 (CVSS v4.0 6.9 – medium), which allows an unauthenticated attacker to bypass REST API authentication using a forged federation token; and CVE-2025-64394 (CVSS v4.0 4.3 – medium), which allows a low-privileged local user to write arbitrary files with SYSTEM privileges during installation, with possible privilege escalation or denial of service.

Veeam ONE 13.1

CVE-2026-107671 (CVSS v4.0 8.5 – high, not critical) allows an attacker who already has valid Administrator credentials to bypass multi-factor authentication (MFA) by disabling it globally before completing verification.

The vendor warns that, once the vulnerabilities and their patches have been disclosed, attackers are likely to attempt to reverse-engineer the patches to exploit unpatched deployments; therefore, prompt application of the updates is recommended.

Solution

The solution is to update to the fixed versions specified by the vendor:

ProductFixed version
Veeam Backup & Replication 13.113.1.2 (build 13.1.2.57)
Veeam Backup & Replication 13.013.0.3 (build 13.0.3.63)
Veeam Agent for Linux 13.113.1.2 (build 13.1.2.11)
Veeam Backup for Microsoft 3658.6 Patch 1 (build 8.6.0.5011), which fixes all the listed issues; version 8.6 (build 8.6.0.1102) fixes only CVE-2026-106076 and CVE-2026-106077
Veeam ONE 13.113.1 Patch 1 (build 13.1.0.7940)

For Veeam Backup for Microsoft 365, directly updating to 8.6 Patch 1 is recommended.

As a best practice, backup servers and their management services should not be exposed to the Internet; it is also recommended to segment the backup network and restrict administrative access.

Additional information: