A backup console that can be reached without valid credentials is among the flaws IT teams dread most. Veeam disclosed exactly that kind of problem on October 27, 2026, when it published CVE-2026-108142 for Backup & Replication with a CVSS v4.0 score of 9.1.
Veeam's security advisory, KB4948, covers the bug. According to Cybersecurity News, an attacker with no login credentials can get past access checks on the CDP Coordinator Service. The flaw affects Windows-based deployments and the Veeam Software Appliance.
The same release also fixes two medium-severity flaws, CVE-2026-108140 and CVE-2026-108141, each scored 5.9 on CVSS v4.0. SOCPrime reports that Veeam's release information lists build 13.1.2.57 as a cumulative patch that addresses security vulnerabilities along with other reported issues.
Why a 9.1 score on a backup console matters
The score reflects the access problem. A 9.1 signals unauthenticated access, which is more serious than a local bug or one that requires an existing login. Severity scores measure theoretical risk, though, so the number tells you how bad a flaw could be, not how often it is being used.
The target raises the stakes. Backup consoles hold stored credentials and copies of production data, and attackers who reach backups can hinder recovery. Backup servers are a common ransomware target for U.S. companies and hospitals, which is why a login bypass on one deserves attention beyond the usual patch queue.
Whether the risk applies to you depends on reachability. A console locked to a management network is a different problem from one visible to a general corporate subnet, and the reporting reviewed does not settle that question for every deployment. Treat exposure as something to answer on your own network, not something to assume.
The exposure is also uneven. Managed service providers that run Veeam for clients may face broader exposure across multiple tenants, according to SecurityWeek. In our view, smaller IT teams without dedicated security staff carry the most risk over the next few weeks, because they often patch late. Hospitals have felt this kind of disruption firsthand: our University Hospitals MyChart coverage describes a system still down a week after a cyberattack.
Which Veeam versions are affected
Veeam ties the flaw to build numbers rather than broad version families. Its advisory covers the 13.1 branch through build 13.1.1.18 and the 13.0 branch through build 13.0.2.29. Veeam identifies version 12.x as unaffected by this issue.
| Branch | Affected builds | Status in Veeam's advisory |
|---|---|---|
| 13.1 | 13.1.1.18 and earlier | Affected; cumulative fix cited as 13.1.2.57 |
| 13.0 | 13.0.2.29 and earlier | Affected |
| 12.x | None listed | Identified as unaffected |
Read the exact build on every server, including appliances, rather than relying on a version label. Also confirm the 12.x claim against Veeam's documentation before treating those servers as safe, since the reporting reviewed adds no detail on that branch.
How many Veeam fixes shipped, and why sources disagree
SecurityOnline counted five vulnerabilities across two advisories, one critical, two high and two medium. SOCPrime counted four issues, and SecurityWeek cited nine defects across Veeam products. Until the count is checked against KB4948 itself, treat any single number as provisional.
Build coverage is a separate question. The reporting reviewed does not confirm whether 13.1.2.57 is the only fix path for every affected branch. Administrators on 13.0 should read the advisory's fix guidance rather than assume the 13.1 build applies to them.
The same week brought fixes from Adobe and Juniper Networks. SecurityWeek counted more than three dozen vulnerabilities across the three vendors, including multiple critical code execution flaws. Adobe fixed 12 issues and said it knew of no exploitation. Juniper patched 18 vulnerabilities in its Session Smart Router and Session Smart Conductor products, including two critical flaws, and said it found the bugs internally and knew of none exploited in the wild.
The same pressure shows up elsewhere. A Cisco firewall VPN zero-day carries a federal deadline of Nov. 1, which leaves little slack for teams juggling several vendor updates at once.
A separate Veeam flaw, CVE-2023-22793, appeared with an October 29 update date in one feed. This article did not verify its status, and it is not part of the CVE-2026-108142 advisory, so do not treat the two as the same issue.
Is CVE-2026-108142 being exploited yet
Not according to the reporting reviewed. No confirmed attacks appear in those sources, and no Veeam spokesperson statement turned up. The420 notes that these releases close potential entry points rather than responding to a confirmed mass-exploitation campaign.
That separates this batch from flaws already under attack. Our GitLab coverage describes a maximum-severity bug that CISA says is under active attack, a different level of urgency. This article also did not confirm whether CVE-2026-108142 appears in CISA's Known Exploited Vulnerabilities catalog, so check that list before closing a ticket. Public proof-of-concept code had not surfaced in the reporting reviewed.
Our analysis is that the quiet period will not last long. A login bypass on a backup console is the kind of bug ransomware crews tend to weaponize once exploit details circulate. The lack of confirmed attacks today describes the window, not the risk.
Steps to take this week
Start with any backup console reachable from outside a management network, then work through the rest of the fleet.
- Inventory every Veeam Backup & Replication server, including Windows hosts and Veeam Software Appliances, and record each exact build number.
- If a server runs 13.1.1.18 or earlier, or 13.0.2.29 or earlier, schedule the update to the fixed build in KB4948. Veeam's release information cites 13.1.2.57 as the cumulative fix for the 13.1 branch, so confirm the 13.0 path in the advisory.
- Restrict who can reach the backup console and the CDP Coordinator Service, and move management interfaces onto a restricted admin network where possible.
- Confirm that at least one recent backup copy is offline or immutable, and test a restore before you need one.
- Review authentication and console logs for activity that does not match a legitimate login, and escalate anything unexpected.
- If you run Veeam for clients, check every tenant's deployment and version.
What to watch next
Three signals will show whether this moves from a patch-now item to an active incident. The first is whether KB4948 gets revised and the fix count converges across sources. The second is whether CISA adds CVE-2026-108142 to its Known Exploited Vulnerabilities catalog. The third is whether public exploit code appears, which would shorten the time administrators have. Teams that finish this week with a verified inventory and a tested restore will be in a far better position if the answer to any of those questions changes.
