SB2026103040 - Multiple vulnerabilities in Veeam Backup & Replication
Published: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper Authorization (CVE-ID: CVE-2026-108142)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization on the CDP Coordinator Service.
The vulnerability exists due to improper authorization in the CDP Coordinator Service in Veeam Backup & Replication when handling requests. A remote attacker can bypass authorization checks to access service functionality without the required permissions.
2) Path traversal (CVE-ID: CVE-2026-108140)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to write attacker-controlled files to arbitrary paths on the backup server.
The vulnerability exists due to relative path traversal in the handling of backed-up NAS share contents in Veeam Backup & Replication. A remote privileged user can use the Restore Operator role and control over the contents of a backed-up NAS share to write files outside the intended directory on the backup server.
3) Path traversal (CVE-ID: CVE-2026-108141)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to write attacker-controlled files to arbitrary paths on the backup server.
The vulnerability exists due to relative path traversal in the handling of backed-up NAS share contents in Veeam Backup & Replication. A remote privileged user can use the Restore Operator role and control over the contents of a backed-up NAS share to write files outside the intended directory on the backup server.
4) Improper privilege management (CVE-ID: CVE-2026-105477)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the local system.
The vulnerability exists due to improper privilege management in Veeam Agent for Linux when operating on the local system. A local user can exploit the agent's privilege handling to gain permissions beyond those assigned to their account.
Only installations managed by a Veeam Backup & Replication instance are affected.
Remediation
Install update from vendor's website.