🚨🇺🇸 Veeam patches critical Backup & Replication authorization bypass Veeam has released security updates addressing five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE. ⠀ The most serious, CVE-2026-108142, carries a CVSS score of 9.1 and allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. ⠀ Other patched vulnerabilities include: • CVE-2026-105477: Local privilege escalation in managed Veeam Agent for Linux installations, CVSS 7.3 • CVE-2026-108140: Arbitrary file writes through path traversal, CVSS 5.9 • CVE-2026-108141: Arbitrary file writes through path traversal, CVSS 5.9 • CVE-2026-107671: Veeam ONE administrator can bypass MFA by disabling it before completing verification, CVSS 8.5 ⠀ Backup & Replication versions 13.0 and 13.1 are affected by the authorization and path-traversal flaws. Older 12.x releases are not affected by those specific issues. ⠀ Administrators should update to: • Backup & Replication 13.1.2 build 13.1.2.57 • Backup & Replication 13.0.3 build 13.0.3.63 • Veeam Agent for Linux 13.1.2 build 13.1.2.11 • Veeam ONE 13.1 P1 build 13.1.0.7940
