EN PT-BR
← Voltar ao feed
high

Veeam patches critical CVE-2026-108142 and eight other flaws in Backup & Replication, Agent for Linux, M365 and ONE

2 fonte(s) · 2 atualização(ões) · publicado 27/10/2026 21:00 · coletado há 3 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:02; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ gbhackers.com ↗

Veeam released security updates on 27 October 2026 (bulletins kb4948, kb4951 and kb4957) fixing nine CVEs across Veeam Backup & Replication, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE. The most severe is CVE-2026-108142, a critical unauthenticated authorization bypass (CVSS v4.0 9.1) in the CDP Coordinator Service of Backup & Replication 13.x (gbhackers.com). CERT-FR advisory CERTFR-2026-AVI-1399 (28 October 2026) warns that some of the flaws allow remote arbitrary code execution, privilege escalation, confidentiality and integrity breaches, and security policy bypass (cert.cyber.gouv.fr). Neither source reports exploitation in the wild. Defenders should upgrade to the fixed builds listed below.

Entenda a falha

A vulnerabilidade

The most severe is CVE-2026-108142 (CVSS v4.0 9.1), an authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication. An unauthenticated attacker can exploit it; Windows deployments and the Veeam Software Appliance are affected. Affected builds are 13.1.1.18 and earlier (13.1 branch) and 13.0.2.29 and earlier (13.0 branch); 12.x is not affected. Fixes are 13.1.2.57 and 13.0.3.63. The advisory does not say it gives remote code execution or backup deletion. CVE-2026-108140 and CVE-2026-108141 (5.9) are relative path traversals: an authenticated user with the Restore Operator role who controls the contents of a backed-up NAS share can write controlled files to an arbitrary location on the backup server. CVE-2026-105477 (7.3) is a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier, only when managed by Backup & Replication; the fix is 13.1.2.11. CERT-FR lists five more CVEs (CVE-2025-64394, CVE-2026-106076, -106077, -106078, -107671) that affect Backup for Microsoft 365 before 8.6 Patch 1 (8.6.0.5011) and Veeam ONE before 13.1 P1 (13.1.0.7940). The articles give no detail on them.

Como funciona

For CVE-2026-108142, a request reaches the CDP Coordinator Service of the backup server and the service is supposed to check that the caller is authorized. The flaw is at that step: the authorization check can be bypassed, so an unauthenticated caller is treated as allowed. The articles do not name the endpoint or say what actions this exposes. For the path traversal flaws, a Restore Operator restores data from a backed-up NAS share whose contents the attacker controls. The file paths in that content contain relative components, so files are written outside the intended location on the backup server. The articles do not describe the mechanism of the Agent for Linux privilege escalation.

Por que é vulnerável

The articles do not state root causes. From the descriptions, CVE-2026-108142 is a missing or flawed authorization check in the CDP Coordinator Service, and CVE-2026-108140 and CVE-2026-108141 are relative path traversal, meaning file paths from backed-up content are not properly kept inside the intended restore location. Veeam gives similar public descriptions for the two path traversals and does not explain how they differ. Nothing is said about why the flaws went unnoticed. The fix is delivered in the new builds, but the articles do not describe what changed in the code.

Como foi descoberta

Veeam disclosed the issues in security bulletins kb4948, kb4951 and kb4957 on 27 October 2026, and CERT-FR published advisory CERTFR-2026-AVI-1399 on 28 October 2026. The articles do not say who found the flaws or how they were reported. Neither source reports exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:17.

Detalhes técnicos

  • CVE-2026-108142 (CVSS v4.0 9.1): authorization bypass in the CDP Coordinator Service, exploitable by an unauthenticated attacker. It affects Windows deployments and the Veeam Software Appliance: 13.1.1.18 and earlier in the 13.1 branch, and 13.0.2.29 and earlier in the 13.0 branch. Version 12.x is not affected. The advisory does not state that it enables remote code execution, backup deletion or full server compromise, and gives no exploitation sequence or affected endpoint (gbhackers.com).
  • CVE-2026-108140 and CVE-2026-108141 (CVSS v4.0 5.9 each): relative path traversal. They require an authenticated user with the Restore Operator role who controls the contents of a backed-up NAS share, and allow writing controlled files to an arbitrary location on the backup server (gbhackers.com).
  • CVE-2026-105477 (CVSS v4.0 7.3): local privilege escalation in Veeam Agent for Linux, affecting only installations managed by Backup & Replication, specifically Agent 13.1.1.4 and earlier in the 13.1 branch. The 13.0.x and 6.x versions are not affected (gbhackers.com).
  • CERT-FR lists nine CVEs in total: CVE-2025-64394, CVE-2026-105477, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2026-107671, CVE-2026-108140, CVE-2026-108141 and CVE-2026-108142. Only four of them are described in detail by gbhackers.com (cert.cyber.gouv.fr).
  • Affected products per CERT-FR: Veeam Agent for Linux < 13.1.2 (build 13.1.2.11); Veeam Backup & Replication 13.0.x < 13.0.3 (build 13.0.3.63) and 13.1.x < 13.1.2 (build 13.1.2.57); Veeam Backup for Microsoft 365 < 8.6 Patch 1 (build 8.6.0.5011); Veeam ONE < 13.1 P1 (build 13.1.0.7940) (cert.cyber.gouv.fr).

Remediação

  • Apply the vendor updates described in Veeam bulletins kb4948, kb4951 and kb4957 (cert.cyber.gouv.fr).
  • Upgrade Backup & Replication to 13.1.2.57 or 13.0.3.63, depending on the branch. The path traversal flaws are fixed in the same builds (gbhackers.com).
  • Agent for Linux 13.1.2.11, included in Backup & Replication 13.1.2, fixes CVE-2026-105477 (gbhackers.com).
  • Update Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940) (cert.cyber.gouv.fr).
  • Windows upgrades to 13.1.2 require the full deployment ISO or the built-in updater, because no standalone patch ISO or ZIP exists. Appliance upgrades can be done internally and may require a reboot (gbhackers.com).
  • Check the installed version under Help > About in the console before choosing the upgrade path (gbhackers.com).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 27/10/2026 21:00 · coletado 29/10 13:01

    CERT-FR advisory: multiple vulnerabilities in Veeam products allow remote code execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1399 on 28 October 2026 covering multiple vulnerabilities in Veeam products. Some of the flaws allow remote arbitrary code execution, privilege escalation, data confidentiality and integrity breaches, and security policy bypass. Affected products include Veeam Backup & Replication, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE. Veeam published security bulletins kb4948, kb4951 and kb4957 on 27 October 2026. Nine CVEs are referenced; no exploitation in the wild is mentioned.

    Technical Details

    • Veeam Agent for Linux < 13.1.2 (build 13.1.2.11)
    • Veeam Backup & Replication 13.0.x < 13.0.3 (build 13.0.3.63) and 13.1.x < 13.1.2 (build 13.1.2.57)
    • Veeam Backup for Microsoft 365 < 8.6 Patch 1 (build 8.6.0.5011)
    • Veeam ONE < 13.1 P1 (build 13.1.0.7940)
    • CVEs: CVE-2025-64394, CVE-2026-105477, CVE-2026-106076, CVE-2026-106077, CVE-2026-106078, CVE-2026-107671, CVE-2026-108140, CVE-2026-108141, CVE-2026-108142.

    Remediation

    • Apply the vendor updates described in Veeam bulletins kb4948, kb4951 and kb4957.
  2. gbhackers.com ↗ · pub. 28/10/2026 08:23 · coletado 28/10 10:00 primeiro registro

    Veeam patches critical unauthenticated authorization bypass CVE-2026-108142 in Backup & Replication 13.x CDP Coordinator Service

    ler a análise desta fonte

    Veeam released security updates on October 27, 2026 (advisory KB4948) for CVE-2026-108142, a critical authorization bypass (CVSS v4.0 9.1) in the CDP Coordinator Service of Veeam Backup & Replication. An unauthenticated attacker can exploit it, and it affects Windows deployments and the Veeam Software Appliance. The advisory also fixes two medium-severity path traversal flaws and a high-severity local privilege escalation in managed Veeam Agent for Linux. The article does not report in-the-wild exploitation.

    Technical Details

    • CVE-2026-108142 (CVSS v4.0 9.1): authorization bypass on the CDP Coordinator Service. It affects 13.1.1.18 and earlier in the 13.1 branch and 13.0.2.29 and earlier in the 13.0 branch. Version 12.x is not affected. The advisory does not state that it enables remote code execution, backup deletion or full server compromise, and it gives no exploitation sequence or affected endpoint.
    • CVE-2026-108140 and CVE-2026-108141 (CVSS v4.0 5.9 each): relative path traversal. They require an authenticated user with the Restore Operator role who controls the contents of a backed-up NAS share, and they allow writing controlled files to an arbitrary location on the backup server.
    • CVE-2026-105477 (CVSS v4.0 7.3): local privilege escalation in Veeam Agent for Linux. It affects only installations managed by Backup & Replication, specifically Agent 13.1.1.4 and earlier in the 13.1 branch. The 13.0.x and 6.x versions are not affected.

    Remediation

    • Upgrade to Backup & Replication 13.1.2.57 or 13.0.3.63, depending on your branch. The path traversal flaws are fixed in the same builds.
    • Agent for Linux 13.1.2.11, included in Backup & Replication 13.1.2, fixes CVE-2026-105477.
    • Windows upgrades to 13.1.2 require the full deployment ISO or the built-in updater, because no standalone patch ISO or ZIP exists. Appliance upgrades can be done internally and may require a reboot.
    • Check the installed version under Help > About in the console before choosing the upgrade path.