Critical severity · published Oct 27, 2026
CVE-2026-108142
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service
New
9.1
CVSS
–
EPSS
No
On KEV
Description
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Backup & Replication · Veeam
13.0 before 13.0.3; 13.1 before 13.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108142
www.veeam.com
https://www.veeam.com/kb4948
More from Backup & Replication
9.8
CVE-2024-40711
Veeam Backup and Replication Deserialization Vulnerability
9.8
CVE-2022-26501
Veeam Backup & Replication Remote Code Execution Vulnerability
8.8
CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability
7.5
CVE-2023-27532
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
9.9
CVE-2026-21708
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user