We’d like to make you aware of several security vulnerabilities recently disclosed by Veeam affecting Veeam Backup & Replication v13 and Veeam Agent for Linux. The most serious carries a CVSS score of 9.1 and could allow an unauthenticated attacker to bypass authorisation on the backup server, so we recommend prompt attention.
Summary of the Vulnerabilities:
- CVE-2026-108142 (CVSS 9.1, Critical) – An authorisation bypass in the CDP Coordinator Service, exploitable by an unauthenticated attacker over the network.
- CVE-2026-108140 and CVE-2026-108141 (CVSS 5.9, Medium) – Path traversal flaws allowing a user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary location on the backup server.
- CVE-2026-105477 (CVSS 7.3, High) – A local privilege escalation flaw in Veeam Agent for Linux. Only agents managed by a Veeam Backup & Replication server are affected.
- Important: Version 12 builds are not affected by these issues. Both Windows-based Veeam Backup & Replication and the Veeam Software Appliance are in scope.
- Full Veeam article can be found here.
What's Affected:
- Veeam Backup & Replication 13.1 (builds 13.1.1.18 and earlier)
- Veeam Backup & Replication 13.0 (builds 13.0.2.29 and earlier)
- Veeam Agent for Linux 13.1 (builds 13.1.1.4 and earlier), when managed by Veeam Backup & Replication
- Veeam Backup & Replication 12.x and Veeam Agent for Linux 13.0.x / 6.x are not affected.
Recommended Action:
We strongly encourage reviewing your environment to identify if you are running an affected version. These vulnerabilities are resolved in the following builds, and we recommend updating as soon as possible to reduce exposure:
- Veeam Backup & Replication 13.1.2 (build 13.1.2.57)
- Veeam Backup & Replication 13.0.3 (build 13.0.3.63)
- Veeam Agent for Linux 13.1.2 (build 13.1.2.11)
Once a vulnerability and its patch are publicly disclosed, attackers commonly attempt to reverse-engineer the fix to target unpatched deployments, so prompt patching matters here.
At Kyocera, we understand the critical importance of securing your infrastructure. If you need help reviewing your environment, checking for compromise or applying the update, please contact our team. You can reach our helpdesk at help@dau.kyocera.com.
