Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1092 _____________________________________________________________________ DATE : 28/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Veeam Backup & Replication versions prior to 13.1.2 (build 13.1.2.57), 13.0.3 (build 13.0.3.63), Veeam Backup for Microsoft 365 versions prior to 8.6 (build 8.6.0.1102), Veeam ONE versions prior to 13.1 P1 (build 13.1.0.7940). ==================================================================== https://www.veeam.com/kb4948 https://www.veeam.com/kb4957 https://www.veeam.com/kb4951 _____________________________________________________________________ Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2 KB ID: 4948 Product: Veeam Backup & Replication | 13 | 13.1 Published: 2026-10-27 Last Modified: 2026-10-27 Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. Severity: Critical CVSS v4.0 Score: 9.1 Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Reported through HackerOne. Affected Product Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds. Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds. Note: Older versions (e.g., 12.x) are not affected. Solution This vulnerability was fixed starting in the following builds: Veeam Backup & Replication 13.1.2 (build 13.1.2.57) Veeam Backup & Replication 13.0.3 (build 13.0.3.63) CVE-2026-108140 A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. Severity: Medium CVSS v4.0 Score: 5.9 Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Reported through HackerOne. Affected Product Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds. Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds. Note: Older versions (e.g., 12.x) are not affected. Solution This vulnerability was fixed starting in the following builds: Veeam Backup & Replication 13.1.2 (build 13.1.2.57) Veeam Backup & Replication 13.0.3 (build 13.0.3.63) CVE-2026-108141 A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. Severity: Medium CVSS v4.0 Score: 5.9 Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Reported through HackerOne. Affected Product Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds. Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds. Note: Older versions (e.g., 12.x) are not affected. Solution This vulnerability was fixed starting in the following builds: Veeam Backup & Replication 13.1.2 (build 13.1.2.57) Veeam Backup & Replication 13.0.3 (build 13.0.3.63) CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected. Severity: High CVSS v4.0 Score: 7.3 Source: Reported through HackerOne. Affected Product Veeam Agent for Linux 13.1.1.4 and all earlier version 13.1 builds. Note: Older versions (e.g., 13.0.x and 6.x) are not affected. Solution This vulnerability was fixed starting in the following build: Veeam Agent for Linux 13.1.2 (build 13.1.2.11) If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter. __________________________________________________________________ Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6 KB ID: 4957 Product: Veeam Backup for Microsoft 365 | 8.6 Published: 2026-10-27 Last Modified: 2026-10-26 Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. Severity: Critical CVSS v4.0 Score: 9.0 Source: Reported through HackerOne. Affected Product Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds. Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102) CVE-2026-106077 A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges. Severity: High CVSS v4.0 Score: 8.3 Source: Reported through HackerOne. Affected Product Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds. Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102) CVE-2026-106078 A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. Severity: Medium CVSS v4.0 Score: 6.9 Source: Reported through HackerOne. Affected Product Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds. Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) CVE-2025-64394 A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service. Severity: Medium CVSS v4.0 Score: 4.3 Source: Reported through HackerOne. Affected Product Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds. Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011) If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter. _____________________________________________________________________ Vulnerabilities Resolved in Veeam ONE 13.1 P1 KB ID: 4951 Product: Veeam ONE | 13.1 Published: 2026-10-27 Last Modified: 2026-10-27 Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. Severity: High CVSS v4.0 Score: 8.5 Source: Reported through HackerOne. Affected Product Veeam ONE 13.1.0.7233 and all earlier version 13.1 builds. Note: Older versions (e.g., 13.0.x and 12.x) are not affected. Solution This vulnerability was fixed starting in the following build: Veeam ONE 13.1 P1 (build 13.1.0.7940) If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================