Veeam Backup Servers Need Updates After Critical Access and MFA Flaws
Veeam administrators have new security updates to apply after four vulnerabilities were reported across Veeam Backup & Replication, Veeam Agent for Linux and Veeam ONE. The most serious issue affects the Windows version of Backup & Replication and can allow unauthenticated access to its Continuous Data Protection service. Under specific conditions, administrators also need to address a Veeam ONE flaw that can disable multi-factor authentication.
The report, published on October 28, says that security patches are available and recommends installing them promptly because backup servers are attractive targets for ransomware groups. That risk context does not mean an attack is underway: the same report says the vendor has no current indications that attackers are exploiting these vulnerabilities.
The critical vulnerability is CVE-2026-108142. It affects the Windows version of Veeam Backup & Replication and concerns the CDP service, which runs on the backup server and coordinates replication and data-transfer tasks. The report says an attacker may be able to reach that service without authentication and could subsequently disrupt backup plans. Two additional Windows flaws, CVE-2026-108140 and CVE-2026-108141, are rated medium. Exploiting those issues requires the Restore Operator role as well as control of the contents of a backed-up NAS share; the resulting path-traversal issue can write files to arbitrary paths on the backup server.
For the Windows components, administrators should install Veeam Backup & Replication version 13.1.2.57 or 13.0.3.63. Environments using Veeam Agent for Linux should move to version 13.1.2.11 when the agent is managed by a Backup & Replication instance. That separate issue, CVE-2026-105477, is rated high and can allow privilege escalation.
Veeam ONE requires a separate check. CVE-2026-107671 is rated high and can let an attacker disable MFA if that attacker already has administrator credentials. Version 13.1.0.7940 contains the stated fix. The practical priority is therefore to inventory these three Veeam products, match each installation to the affected component and apply the corresponding fixed version, while treating the absence of known exploitation as limited reassurance rather than a reason to postpone patching.