Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Veeam Backup & Replication CDP Coordinator can be accessed without login

CVE-2026-108142 · published today
Summary

The CDP Coordinator service in Veeam Backup & Replication can be reached by anyone on the network without proving their identity, allowing them to bypass normal permission checks. This could let an attacker view or modify backup data or configuration. Apply the latest Veeam update and limit network access to the service to trusted hosts.

What to do
  • Update veeam backup and replication to version 13.0.3 or later.
Affected software
VendorProductAffected versions
veeam backup and replication < 13.0.3
Original advisory text
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
References
Severity
9.1 Critical
Type
CWE-636Not Failing Securely ('Failing Open')
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-108142 · NVD
CVE-2026-108142 · MITRE
Track software like this
Free during beta