Our experts keep you up-to-date on critical cyber threats (CVEs)
Veeam reports a Critical vulnerability (CVSS 9.1) in Veeam Backup & Replication, known as CVE-2026-108142.
The vulnerability lies in the CDP Coordinator Service. This allows an attacker to by bypassing authorisation without logging in. Veeam has released an update to address this. Only version 13 is affected; version 12.x is not affected.
At VanRoey, we work for all our Managed Services customers a robust baseline based on best practice and experience. Applying the backup bunker principle addresses this vulnerability, meaning that applying the patch is currently optional. Are you unsure whether the backup bunker has been implemented in your environment? If so, please contact your usual point of contact at VanRoey.
If you want to get started yourself, here are the steps:
Veeam Backup & Replication 13.1 13.1.1.18 and earlier 13.1 builds > Upgrade to 13.1.2 (build 13.1.2.57) or later
Veeam Backup & Replication 13.0, 13.0.2.29 and earlier 13.0 builds > Upgrade to 13.0.3 (build 13.0.3.63) or later
Attention: During the update, the backup server will be temporarily unavailable and no backup jobs will be running. You can find the upgrade steps under Veeam (KB4738). Further details on the vulnerability can be found in the advisory from Veeam (KB4948).
Would you like VanRoey to update your Veeam environment, or would you like to find out more about the backup bunker? Please contact us by email at support@vanroey.be (Enter Veeam your version) or call: 014 470 605. You can also create a ticket.
Can't create tickets? Ask here to get an account. If our Engineer needs to remotely control your PC, he or she will ask you to run this software .
Receive our newsletter including invitations to events & interesting industry news!
Receive alerts from current CVEs and tips to remedy them!
Discover how AI, ERP, customer engagement, e-commerce, SharePoint and data can connect your organisation more intelligently.
Attention: last places!