Live › vulnerability › CVE-2026-108142
Go to dashboardVeeam Backup & Replication's CDP Coordinator Service (VeeamBackupCdpSvc, on the backup server) lets an unauthenticated network attacker bypass authorization. Veeam rates it Critical (CVSS v4 9.1), reported via HackerOne. Veeam gives no exploitation details and we found no exploitation or public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Anyone running Veeam Backup & Replication 13.0 or 13.1, Windows-based or Veeam Software Appliance, below the fixed builds. The CDP Coordinator Service runs on the backup server, so look at any backup server whose network is reachable by untrusted hosts. Version 12.x installs can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup & Replication | vendor | <= 13.1.1.18 (13.1); <= 13.0.2.29 (13.0) | 13.1.2.57, 13.0.3.63 |
13.1.1.18 and earlier 13.1, or 13.0.2.29 and earlier 13.0, are vulnerable. 12.x is not affected13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
This page as .md · .json · in your agent: get_signal("CVE-2026-108142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.