Backup servers are a favourite ransomware target, and Veeam bugs have been weaponized quickly after past patches, so treat these as priority even though Veeam reports no exploitation.

• CVE-2026-108142 (CVSS 4.0 9.1): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service. Affects Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, on Windows and the Veeam Software Appliance. Fixed in 13.1.2 (13.1.2.57) and 13.0.3 (13.0.3.63). Version 12.x is not affected. The same update fixes several lower-rated bugs, including a path traversal by a Restore Operator.
• CVE-2026-106076 (CVSS 4.0 9.0): in Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, giving cross-tenant read/write of configuration data and code execution as the PostgreSQL service account. Affects 8.5.0.1014 and earlier v8 builds; fixed in 8.6 (8.6.0.1102). Go straight to 8.6 Patch 1 (8.6.0.5011), which also fixes a REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug.

What to do: upgrade, keep the backup server and its services off the general network and the internet, and make sure the backup server is not joined to the production domain.