---
title: Veeam patches a critical unauthenticated authorization bypass in Backup & Replication 13 (CVE-2026-108142) and a critical cross-tenant SQL injection to RCE in Backup for Microsoft 365 (CVE-2026-106076) | ctxsec
url: https://ctxsec.com/items/veeam-br13-cdp-coordinator-cve-2026-108142-vb365-cve-2026-106076
description: ""
status: "official (Veeam KB4948 and KB4957, Oct 27); no exploitation reported"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/veeam-br13-cdp-coordinator-cve-2026-108142-vb365-cve-2026-106076.md)

official (Veeam KB4948 and KB4957, Oct 27); no exploitation reported

2026-10-29

### Veeam patches a critical unauthenticated authorization bypass in Backup & Replication 13 (CVE-2026-108142) and a critical cross-tenant SQL injection to RCE in Backup for Microsoft 365 (CVE-2026-106076)

Backup servers are a favourite ransomware target, and Veeam bugs have been weaponized quickly after past patches, so treat these as priority even though Veeam reports no exploitation.

- **CVE-2026-108142 (CVSS 4.0 9.1):** an unauthenticated attacker can bypass authorization on the **CDP Coordinator Service**. Affects Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, on Windows and the Veeam Software Appliance. **Fixed in 13.1.2 (13.1.2.57) and 13.0.3 (13.0.3.63).** Version 12.x is not affected. The same update fixes several lower-rated bugs, including a path traversal by a Restore Operator.
- **CVE-2026-106076 (CVSS 4.0 9.0):** in Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, giving cross-tenant read/write of configuration data and code execution as the PostgreSQL service account. Affects 8.5.0.1014 and earlier v8 builds; fixed in 8.6 (8.6.0.1102). Go straight to **8.6 Patch 1 (8.6.0.5011)**, which also fixes a REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug.

**What to do:** upgrade, keep the backup server and its services off the general network and the internet, and make sure the backup server is not joined to the production domain.

Sources: [Veeam KB4948: Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 (Oct 27)](https://www.veeam.com/kb4948) · [Veeam KB4957: Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 (Oct 27)](https://www.veeam.com/kb4957)