Dark Web Informer (@DarkWebInformer) on X

What it is

Veeam released fixes on or before this post for five vulnerabilities in Backup & Replication, Veeam Agent for Linux and Veeam ONE. The post is a social media digest, not the vendor advisory, so it gives no exploit detail. The worst is CVE-2026-108142 (CVSS 9.1), which lets an unauthenticated attacker bypass authorization on the CDP Coordinator Service.

The five CVEs

• CVE-2026-108142, CVSS 9.1: authorization bypass in the CDP Coordinator Service, no authentication needed.
• CVE-2026-107671, CVSS 8.5: a Veeam ONE administrator can bypass MFA by disabling it before completing verification.
• CVE-2026-105477, CVSS 7.3: local privilege escalation in managed Veeam Agent for Linux installations.
• CVE-2026-108140, CVSS 5.9: arbitrary file writes through path traversal.
• CVE-2026-108141, CVSS 5.9: arbitrary file writes through path traversal, separate from the one above.

Preconditions / Affected

Backup & Replication 13.0 and 13.1 are affected by the authorization bypass and the two path-traversal flaws. The post says 12.x releases are not affected by those specific issues. The Veeam ONE MFA bypass needs an administrator account. The post does not give affected version ranges for Veeam ONE or Veeam Agent for Linux, and it does not say which path-traversal CVE applies to which product.

What to do

Update to these builds:

Backup & Replication 13.1.2  build 13.1.2.57
Backup & Replication 13.0.3  build 13.0.3.63
Veeam Agent for Linux 13.1.2 build 13.1.2.11
Veeam ONE 13.1 P1            build 13.1.0.7940

Pick the Backup & Replication build that matches the installed major line (13.1 or 13.0). Check installed build numbers against this list.

Caveats

The post does not say whether any of these flaws are exploited in the wild. It gives no workaround for hosts that cannot be patched promptly, and it does not describe the CDP Coordinator Service or how the bypass works. Confirm the fix-to-CVE mapping and any hotfix prerequisites in Veeam's own advisory before rollout.