Veeam Fixes Critical Backup & Replication 13 Flaw: Update Now

Veeam has released security updates for Veeam Backup & Replication version 13, including a fix for a critical flaw that lets an unauthenticated attacker bypass authorisation on one of the product’s services. Backup servers are a favourite target for ransomware gangs, because destroying backups leaves victims with little choice but to pay, so any organisation running Veeam 13 should plan to update quickly.

Here is what was fixed, which versions are affected and how to update.

What Veeam fixed

Veeam published security advisory KB4948 on 27 October 2026, covering four vulnerabilities across Backup & Replication and Veeam Agent for Linux. A separate advisory, KB4951, covers a high-severity issue in the Veeam ONE monitoring product. All of the issues were reported through Veeam’s HackerOne bug bounty programme.

CVE-2026-108142: critical authorisation bypass

The most serious flaw, rated 9.1 on the CVSS v4.0 scale, allows an unauthenticated attacker to bypass authorisation on the Continuous Data Protection (CDP) Coordinator Service. It affects Windows-based Backup & Replication installations and the Veeam Software Appliance. Veeam has not published technical details of how the flaw could be abused.

CVE-2026-108140 and CVE-2026-108141: path traversal

Two medium-severity flaws, each rated 5.9, let a user with the Restore Operator role who also controls the contents of a backed-up NAS share write files to arbitrary locations on the backup server. Exploiting them requires both that role and control of the share, which limits the risk, but writing files to a backup server is never something you want an attacker to be able to do.

CVE-2026-105477: Linux agent privilege escalation

A high-severity local privilege escalation flaw, rated 7.3, affects Veeam Agent for Linux, but only when the agent is managed by a Backup & Replication server.

Veeam ONE: MFA could be switched off

Security reporting on the KB4951 advisory says CVE-2026-107671, rated 8.5, lets someone with valid administrator credentials disable multi-factor authentication globally before finishing the MFA step. It is fixed in Veeam ONE 13.1 P1 (build 13.1.0.7940).

Which versions are affected

• Backup & Replication 13.1: build 13.1.1.18 and earlier 13.1 builds. Fixed in 13.1.2 (build 13.1.2.57).
• Backup & Replication 13.0: build 13.0.2.29 and earlier 13.0 builds. Fixed in 13.0.3 (build 13.0.3.63).
• Veeam Agent for Linux 13.1: build 13.1.1.4 and earlier 13.1 builds. Fixed in 13.1.2 (build 13.1.2.11).
• Not affected: Veeam says older Backup & Replication versions such as 12.x are not affected by the Backup & Replication flaws, and Linux agent versions 13.0.x and 6.x are not affected by the agent flaw.

At the time of writing, reports describe no confirmed exploitation in the wild and no public proof-of-concept code. That can change quickly once attackers compare patched and unpatched builds, which is why waiting is risky.

Why backup servers need urgent attention

Backups are the last line of defence against ransomware, accidental deletion and hardware failure. Attackers know this, so they routinely go after backup consoles to delete restore points or encrypt backup repositories before launching the main attack. A critical, unauthenticated flaw on a backup server is therefore more serious than the same score on a less sensitive system.

For many small and mid-sized organisations in Nigeria and across Africa, the backup server also sits on the same flat network as everything else, sometimes reachable from user PCs. That makes timely patching and network separation especially important.

It is also worth remembering that a backup product touches almost every important system in an organisation. It holds copies of file shares, databases, email and virtual machines, and usually has privileged credentials to reach them. A weakness in the backup platform can therefore become a path to data theft as well as data destruction, even if the flaw itself looks narrow on paper.

How to update

1. Check your version. In the Backup & Replication console, open Help, then About, and note the build number.
2. Confirm your backups are healthy before any upgrade, and make sure at least one recent copy is offline, immutable or otherwise out of reach of the backup server itself.
3. Download the right release. Windows installations move to 13.1.2 or 13.0.3 using the full installation ISO or the built-in updater; reporting notes there is no small standalone patch file. The Veeam Software Appliance can be updated from within the appliance and may need a reboot.
4. Update connected components. Make sure managed Linux agents receive the 13.1.2 agent, and patch Veeam ONE to 13.1 P1 if you use it.
5. Verify afterwards. Recheck the build number, run a test backup and a test restore.

What you should do

• Schedule the Veeam 13 upgrade this week, prioritising internet-reachable or poorly segmented backup servers.
• Restrict network access to the backup server so only the systems and administrators that need it can connect.
• Review who holds the Restore Operator role and remove it from anyone who does not need it.
• Protect the backup console with multi-factor authentication and separate administrator accounts that are not used for email or browsing.
• Keep at least one immutable or offline backup copy, and test restores regularly so you know your recovery plan works.

Sources

• Veeam KB4948 security advisory
• SecurityOnline: Veeam patches five vulnerabilities
• GBHackers: Critical Veeam Backup & Replication flaw