Attackers can exploit, among other things, a “ critical ” vulnerability in Veeam Backup & Replication to gain tampering access to backup servers. If the prerequisites are met, attackers can disable multi-factor authentication (MFA) in Veeam ONE. Security patches are available for download.
Because ransomware gangs often target backup servers, admins should install the available security patches promptly. The software maker has no current evidence that attackers are already exploiting the vulnerabilities.
According to a security advisory , attackers can exploit three vulnerabilities in the Windows version of Veeam Backup & Replication, and another affects Veeam Agent for Linux. One vulnerability (CVE-2026-108142) is rated “ critical ”.
According to the vulnerability description, attackers can access the Continuous Data Protection (CDP) service without logging in. The service runs on the backup server and coordinates replication and data transfer tasks for the CDP feature. Attackers are therefore expected to be able to disrupt backup plans afterward.
Two other vulnerabilities (CVE-2026-108140, CVE-2026-108141) are rated “ medium ”. In both cases, attackers need the Restore Operator role and control over the contents of a backed-up NAS . They can then use path traversal to write files to any path on the backup server. To protect Windows systems, admins must install version 13.1.2.57 or 13.0.3.63 .
The remaining vulnerability (CVE-2026-105477, rated “ high ”) affects Veeam Agent for Linux when it is managed by a Backup & Replication instance. Attackers can use it to gain elevated privileges. Version 13.1.2.11 fixes the issue.
An attacker with admin credentials can disable MFA in Veeam ONE ( CVE-2026-107671 , rated “ high ”). Version 13.1.0.7940 addresses the issue.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
