CVE-2026-108142

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-28
Weakness: CWE-636

Description

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Summary

CVE-2026-108142 is a critical authorization bypass (CVSS 9.1) in the CDP Coordinator Service that lets an unauthenticated attacker bypass authorization checks. It affects Veeam Backup & Replication and is fixed in versions 13.0.3 and 13.1.2. The flaw is not listed in CISA KEV, so no known exploitation has been confirmed. Upgrade to 13.0.3 or 13.1.2; if you cannot patch immediately, restrict network access to the CDP Coordinator Service.

CVE-2026-108142 هو ثغرة تجاوز تفويض حرجة (CVSS 9.1) في خدمة CDP Coordinator Service تتيح لمهاجم غير مصادق عليه تجاوز فحوصات التفويض. تؤثر الثغرة في Veeam Backup & Replication وتم إصلاحها في الإصدارين 13.0.3 و13.1.2. الثغرة غير مدرجة في CISA KEV، لذا لم يُؤكَّد استغلالها فعلياً. يُنصح بالترقية إلى 13.0.3 أو 13.1.2، وإذا تعذّر التحديث الفوري فيجب تقييد الوصول الشبكي إلى خدمة CDP Coordinator Service.

Affected products

Veeam Backup & Replication: from 13.0 before 13.0.3; from 13.1 before 13.1.2 — fixed in 13.0.3, 13.1.2

How to fix

Upgrade to a fixed version: Veeam Backup & Replication 13.0.3, 13.1.2. Check the vendor advisory for mitigations.

References

https://www.veeam.com/kb4948

Get alerted when CVE-2026-108142 or the next vulnerability affects your stack