Backup servers are a favorite target for ransomware crews, so if you run Veeam, now is the time to install the latest security updates. The vendor has fixed several flaws in Backup & Replication, Veeam Agent for Linux and Veeam ONE. According to Veeam, there is no sign yet that attackers are using them.
Critical flaw in the CDP service
The worst of the bunch is CVE-2026-108142, rated critical. It affects the Windows version of Veeam Backup & Replication. As described, an attacker can reach the Continuous Data Protection (CDP) service without logging in. That service runs on the backup server and coordinates replication and data transfer for CDP. It is reasonable to assume that this opens the door to tampering with backup jobs.
Path traversal and privilege escalation
Veeam rates two more flaws in Backup & Replication (CVE-2026-108140 and CVE-2026-108141) as medium. To exploit them, an attacker needs the Restore Operator role and control over the contents of a backed-up NAS share. They can then write files to arbitrary locations on the backup server through path traversal. On Windows, versions 13.1.2.57 and 13.0.3.63 close the gap.
The fourth flaw (CVE-2026-105477, rated high) sits in Veeam Agent for Linux, as long as a Backup & Replication instance manages it. It lets attackers gain higher privileges. Version 13.1.2.11 fixes it.
MFA in Veeam ONE can be bypassed
Veeam ONE has its own problem. Anyone who gets hold of admin credentials can switch off multi-factor authentication there (CVE-2026-107671, rated high). Version 13.1.0.7940 fixes this.
Our advice: check which versions you are running and patch soon. Backup systems are often your last safety net after an attack, which is exactly why speed matters here.