CVE-2026-108142

Published Oct 27, 2026

Last updated 25 minutes ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-108142 is an authorization bypass vulnerability in Veeam Backup & Replication, disclosed by Veeam on October 27, 2026, in its security advisory KB4948. Reported through HackerOne, the flaw allows an unauthenticated attacker to bypass access checks on the CDP Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue impacts Veeam Backup & Replication version 13.1.1.18 and earlier builds in the 13.1 branch, as well as version 13.0.2.29 and earlier builds in the 13.0 branch, while version 12.x is unaffected. Veeam has resolved the vulnerability in Backup & Replication versions 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).

Description: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Source: support@hackerone.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.1
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

support@hackerone.com: CWE-636

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 22

References