Backup software is what you hope will be there after a terrible week. Which is exactly why a security flaw in it deserves your attention. Veeam says an unauthenticated attacker could bypass authorization on its CDP Coordinator Service.
Check the full build number
The flaw is CVE-2026-108142, rated Critical, CVSS 9.1. It affects Windows-based Veeam Backup & Replication and the Veeam Software Appliance on these builds:
- Version 13.1.1.18 and earlier 13.1 builds
- Version 13.0.2.29 and earlier 13.0 builds
Fixed builds are 13.1.2.57 and 13.0.3.63, respectively. Veeam says 12.x isn’t affected. Check the complete build number, not just the major version. “We’re on Veeam 13” isn’t enough to know whether you need to patch.
Patch promptly, then check your recovery setup
Veeam hasn’t reported confirmed exploitation in the wild. Its advisory also doesn’t say this flaw gives an attacker complete control of the backup server or enables remote code execution. That’s useful context, not a reason to leave an affected system exposed. Veeam warns that attackers may study newly released patches to target systems that haven’t been updated.
If you manage Veeam, here’s the practical checklist:
- Inventory your Veeam deployments and identify affected 13.0 or 13.1 builds.
- Upgrade affected systems to the applicable fixed build, following Veeam’s guidance.
- Limit access to backup infrastructure and management services to trusted systems and administrators.
- Review monitoring for unexpected activity, and make sure your recovery copies are still protected and restorable.
Backup systems are part of your recovery plan, so patching them is part of your recovery plan too. Start by checking the build number, then make the update a priority.
Need a second set of eyes on your backup security and recovery plan?
Book a 15-minute security check
We’ll review your setup and suggest practical next steps, with no obligation.
Sources: Veeam security advisory KB4948 · Cyber Security News