CVE-2026-108142 · Veeam Backup & Replication CDP Coordinator Service unauthenticated…

01 · The Real Story

The fire exit that unlocks the vault when the alarm goes off

CVE-2026-108142 is an authorization bypass in the Veeam Backup & Replication CDP (Continuous Data Protection) Coordinator Service, which orchestrates real-time replication between source hosts and target proxies. The flaw is classified under CWE-636 (*Not Failing Securely / Failing Open*): when the authorization layer encounters a fault condition, it degrades to a permissive state rather than denying access. An unauthenticated, remote attacker who can reach the CDP Coordinator's network ports (TCP 6185, 33034–33035) can trigger this condition and interact with privileged coordinator functions without credentials. Affected versions span VBR 13.0.0 through 13.0.2.29 and 13.1.0 through 13.1.1.18; version 12.x is unaffected. Both Windows and Veeam Software Appliance (Linux) deployments are vulnerable. Fixed builds are 13.0.3 (build 13.0.3.63) and 13.1.2 (build 13.1.2.57), released 2026-08-25 and 2026-10-27 respectively.

The vendor's own CVSSv4.0 of 9.1 (Critical) scores the flaw with AT:P (attack requirements present), meaning a precondition beyond the attacker's direct control must be met — likely a specific service-state or error condition that triggers the fail-open path. The vector also shows no confidentiality impact (VC:N / SC:N) but high integrity and availability impact on both the vulnerable and subsequent systems (VI:H / VA:H / SI:H / SA:H). Veeam explicitly states this does *not* grant direct remote code execution. That nuance matters: this is an authorization bypass that exposes privileged CDP management functions (replication policy manipulation, task disruption, configuration access) rather than arbitrary command execution. The 9.1 score is arguably fair for internet-facing deployments, but since CDP Coordinator ports are almost never exposed to the public internet and the flaw requires an error-triggering precondition, the real-world severity for most enterprises is closer to HIGH than CRITICAL. That said, any attacker with internal network access — exactly the position ransomware operators occupy post-initial-access — can reach these ports trivially.

"Unauthenticated auth bypass on Veeam's CDP Coordinator fails open — backup infrastructure at risk"

02 · The Attack Path

4 steps from start to impact.

STEP 01

Internal network position

The attacker obtains a foothold on the internal network through phishing, VPN compromise, or exploitation of a perimeter device. Veeam CDP Coordinator ports (TCP 6185, 33034–33035) are reachable from the LAN or management VLAN. No internet exposure is required.

Conditions required:

Internal network access or management VLAN reachability
CDP Coordinator Service running and reachable on target VBR server

Where this breaks in practice:

Requires prior compromise — attacker must already be inside the network
Well-segmented environments isolate backup infrastructure on dedicated VLANs with strict ACLs

Detection/coverage: Network IDS/IPS rules monitoring for unexpected connections to Veeam CDP ports. Veeam session logs in Svc.VeeamCDP.log.

STEP 02

Trigger fail-open condition

The attacker sends crafted requests to the CDP Coordinator Service that cause the authorization check to enter a fault state. Because the service fails open (CWE-636), the error condition degrades the authorization posture to permissive rather than denying the request. The AT:P metric in the CVSS vector indicates this trigger is not guaranteed on every attempt — a specific service state or error path must be reached.

Conditions required:

Knowledge of the fail-open trigger (not yet public)
CDP Coordinator Service in a state susceptible to the fault path

Where this breaks in practice:

AT:P means the precondition is not always present — exploitation is probabilistic, not deterministic
No public PoC or exploit code exists as of 2026-10-28

Detection/coverage: Anomalous error spikes in CDP Coordinator logs. Application-layer monitoring for malformed or high-volume requests to CDP ports.

STEP 03

Bypass authorization

Once the fail-open state is triggered, the attacker's session proceeds without valid credentials. They gain access to the CDP Coordinator's management API, which governs replication policy configuration, task orchestration, and infrastructure component communication. The CVSS vector shows no confidentiality impact on the vulnerable system itself, suggesting the bypass grants *write/control* access rather than data exfiltration from the coordinator.

Conditions required:

Successful trigger of the fail-open condition

Where this breaks in practice:

The scope of accessible functions post-bypass is unclear — Veeam's advisory suggests it is broader than information disclosure but narrower than full server compromise
No RCE means the attacker cannot directly execute arbitrary code on the VBR host

Detection/coverage: Audit logs showing unauthenticated API calls to CDP Coordinator. SIEM correlation of VBR events with no matching authenticated session.

STEP 04

Manipulate backup replication infrastructure

With unauthorized access to CDP Coordinator functions, the attacker can disrupt continuous data protection replication, modify replication targets, or disable active CDP policies. In a ransomware scenario, disabling CDP replication before encrypting production systems eliminates the near-zero RPO recovery path. The SI:H / SA:H ratings confirm that subsequent systems (the protected workloads relying on CDP) suffer high integrity and availability impact.

Conditions required:

Sustained unauthorized access to CDP management API

Where this breaks in practice:

Defender may notice replication failures in Veeam console or monitoring dashboards
Destroying CDP replicas does not destroy other backup types (scheduled backups, snapshots) unless separately targeted

Detection/coverage: Veeam Backup & Replication console alerts on CDP policy changes or replication failures. SIEM alerts on VBR configuration modifications outside change windows.

03 · Compensating Control

HIGH 8.2→LOW 3.1

SEVERITY REDUCED

Restrict network access to CDP Coordinator ports — Implement firewall rules or VLAN ACLs that limit TCP 6185, 33034, and 33035 to only authorized CDP proxy hosts and vCenter servers. Block all other source IPs. This eliminates the network reachability prerequisite for any attacker without access to the authorized source hosts. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity. In practice, this should be done within days given ransomware targeting history.

HIGH 8.2→IGNORE 0.0

SEVERITY REDUCED

Patch to VBR 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63) — Apply the vendor fix from KB4948. This eliminates the vulnerability entirely. The 13.0.3 build has been available since 2026-08-25; the 13.1.2 build since 2026-10-27. Schedule within the noisgate remediation SLA of 180 days for HIGH severity, though earlier is strongly recommended given Veeam's exploitation history.

HIGH 8.2→HIGH 7.5

Monitor CDP Coordinator logs for anomalous activity — Enable verbose logging for the Veeam CDP Coordinator Service (Svc.VeeamCDP.log) and forward to SIEM. Alert on unauthenticated connection attempts, unexpected source IPs, CDP policy modifications outside change windows, and error-rate spikes that may indicate fail-open trigger attempts. This does not prevent exploitation but dramatically reduces dwell time.

HIGH 8.2→IGNORE 0.0

SEVERITY REDUCED

Disable CDP features if not actively used — If your environment does not use Continuous Data Protection (many VBR deployments rely solely on scheduled backup jobs), disable the CDP Coordinator Service entirely. This removes the attack surface. Verify that no CDP replication policies are active before disabling. This is a zero-cost control for environments that don't use CDP.

What doesn't work

WAF or reverse proxy in front of VBR — The CDP Coordinator uses proprietary Veeam protocols on non-HTTP ports, not a web API. A WAF cannot inspect or filter this traffic.
MFA on VBR console login — This vulnerability bypasses the CDP Coordinator's authorization entirely at the service level. Console-level MFA does not protect the CDP Coordinator's network-facing service ports.
Veeam encryption at rest — Encrypting backup repositories protects stored data confidentiality, but this CVE targets the CDP *control plane* (replication orchestration), not the data plane. An attacker can disrupt or manipulate replication without touching encrypted data.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Not observed. Not listed in CISA KEV. Veeam's advisory reports no active exploitation as of 2026-10-27. However, Veeam warns that attackers routinely reverse-engineer patches to develop exploits.
Proof-of-Concept	None public. No PoC found on pocindex.io, GitHub, or ExploitDB as of 2026-10-28. The vulnerability was reported through HackerOne (researcher name not disclosed). Given Veeam's history, weaponized tooling typically appears within 2–8 weeks of patch release.
EPSS Score	Not yet scored. FIRST EPSS API returns no data for this CVE (too new — published 2026-10-27). Expect a score within 7–14 days.
KEV Status	Not listed. No CISA KEV entry. Note: Veeam has appeared on KEV four times since 2022, each associated with ransomware campaigns (CVE-2022-26500, CVE-2022-26501, CVE-2023-27532, CVE-2024-40711).
CVSS v4.0 Vector	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H` — Network-reachable, low complexity, attack requirements present, no auth, no interaction. Zero confidentiality impact but high integrity+availability on both vulnerable and subsequent systems.
Affected Versions	VBR 13.0.0 – 13.0.2.29 (all 13.0 builds) and 13.1.0 – 13.1.1.18 (all 13.1 builds). Windows and Veeam Software Appliance (Linux). Version 12.x is not affected.
Fixed Versions	VBR 13.0.3 (build 13.0.3.63, released 2026-08-25) and 13.1.2 (build 13.1.2.57, released 2026-10-27). See KB4948.
Ransomware Targeting Context	Veeam Backup servers are priority ransomware targets. Akira, Fog, Frag, and EstateRansomware have all weaponized prior Veeam CVEs. Sophos X-Ops documented multiple gangs exploiting CVE-2024-40711 within weeks. CVE-2026-21669 (CVSS 9.9, March 2026) was exploited by Akira/Storm-1567 per Wiz.
Internet Exposure	CDP Coordinator ports (6185, 33034–33035) are not standard internet-facing services. No Shodan/Censys banner data available for these ports specifically. Veeam guidance is to keep backup consoles and services off the internet. Real-world exposure is overwhelmingly internal/management-network.
Disclosure / Reporter	Disclosed 2026-10-27 via Veeam KB4948. Reported through HackerOne bug bounty. Researcher identity not disclosed. Patched in the same advisory alongside CVE-2026-108140, CVE-2026-108141 (directory traversal, CVSS 5.9), and CVE-2026-105477 (Linux agent LPE, CVSS 7.3).

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to HIGH (8.2/10)

Why this verdict

No authentication required: The bypass is fully unauthenticated — any network-adjacent attacker can attempt exploitation without credentials, tokens, or session cookies. This eliminates the most common friction point in enterprise attack chains.
AT:P limits reliability: The CVSS AT:P metric means the fail-open trigger depends on a service-state precondition the attacker cannot directly control. This is not a reliable, send-one-packet-and-win exploit — it is probabilistic, which compresses real-world risk below the vendor's 9.1.
No direct RCE: Veeam explicitly states this does not allow remote code execution. The attacker gains unauthorized access to CDP management functions, not a shell. This caps the single-step impact: further damage requires chaining with additional actions (policy manipulation, replication disruption).
Internal network position required: CDP Coordinator ports are management-plane services not exposed to the internet in any standard deployment. Exploitation requires the attacker to already be on the internal network or management VLAN, meaning this is a post-initial-access escalation vector, not an initial-access vector.
Role multiplier — Backup/DR (canonical high-value role): Veeam Backup & Replication is, by definition, backup/DR infrastructure. ≥95% of VBR installations serve this role. The CDP Coordinator manages continuous data protection replication — the near-zero RPO safety net. An attacker who bypasses authorization here can disable CDP policies before launching ransomware, eliminating the organization's best recovery path. The blast radius is fleet-scale: every workload protected by CDP loses its continuous recovery capability. This anchors the floor at HIGH.
Role multiplier — combined with ransomware context: Veeam backup servers are documented priority targets for ransomware operators (Akira, Fog, Frag, EstateRansomware). Four prior Veeam CVEs are on CISA KEV, all linked to ransomware. While this specific CVE lacks RCE, the authorization bypass gives an attacker the ability to *degrade* the backup infrastructure's integrity, which is exactly what ransomware operators need. This reinforces the HIGH floor.
No confidentiality impact limits ceiling: The CVSS vector shows VC:N / SC:N — zero confidentiality impact. The attacker cannot directly exfiltrate backup data or credentials through this vulnerability alone. This distinguishes it from prior CRITICAL Veeam flaws (CVE-2026-21669 at 9.9, CVE-2026-44963 at 9.4) that offered RCE and full server compromise.

Why not higher?

CRITICAL would require either reliable remote code execution or a direct path to full backup server compromise from this single vulnerability. The AT:P metric means exploitation is not deterministic, the vendor confirms no RCE, and there is zero confidentiality impact. The attacker gains control over CDP replication functions — serious for backup integrity — but cannot directly execute code, exfiltrate data, or pivot to other systems without chaining additional vulnerabilities. Prior Veeam CRITICAL flaws (CVE-2026-21669, CVE-2026-44963) all provided authenticated or unauthenticated RCE; this one does not cross that threshold.

Why not lower?

MEDIUM would underestimate the deployment-role blast radius. This vulnerability is *in* a canonical backup/DR product that ransomware gangs demonstrably target. The unauthenticated nature eliminates the most common attack-chain friction. While the internal-network requirement and AT:P add friction, any post-initial-access attacker on the management VLAN — the exact position ransomware operators occupy — can attempt this bypass. Disabling CDP replication before encrypting production workloads is a documented ransomware TTP. The HIGH floor is warranted and binding.

06 · Verification

Crowdsourced verification payload.

Run on each Veeam Backup & Replication server (Windows) or query remotely via PowerShell Remoting. Requires local admin or read access to the registry. Example: .\Check-CVE-2026-108142.ps1 or Invoke-Command -ComputerName VBRSERVER -FilePath .\Check-CVE-2026-108142.ps1

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -Version 5.1
<#
.SYNOPSIS
    Checks whether the local Veeam Backup & Replication installation is
    vulnerable to CVE-2026-108142 (CDP Coordinator auth bypass).
.NOTES
    Exit 1 = VULNERABLE, Exit 0 = PATCHED, Exit 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    # Locate VBR installation via registry
    $regPaths = @(
        'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication',
        'HKLM:\SOFTWARE\Wow6432Node\Veeam\Veeam Backup and Replication'
    )
    $vbrReg = $null
    foreach ($p in $regPaths) {
        if (Test-Path $p) { $vbrReg = Get-ItemProperty -Path $p -ErrorAction SilentlyContinue; break }
    }

    if (-not $vbrReg) {
        Write-Host 'UNKNOWN - Veeam Backup & Replication is not installed on this host.'
        exit 2
    }

    # Get installed version
    $verStr = $vbrReg.Version
    if (-not $verStr) {
        # Fallback: check CorePath exe
        $corePath = $vbrReg.CorePath
        if ($corePath -and (Test-Path "$corePath\Veeam.Backup.Service.exe")) {
            $fi = (Get-Item "$corePath\Veeam.Backup.Service.exe").VersionInfo
            $verStr = $fi.FileVersion
        }
    }

    if (-not $verStr) {
        Write-Host 'UNKNOWN - Could not determine Veeam Backup & Replication version.'
        exit 2
    }

    Write-Host "Detected VBR version: $verStr"
    $ver = [System.Version]$verStr

    # Version 12.x and earlier: not affected
    if ($ver.Major -lt 13) {
        Write-Host "PATCHED - Version $verStr is not affected (only 13.x is vulnerable)."
        exit 0
    }

    # 13.0 branch: vulnerable < 13.0.3.63, fixed >= 13.0.3.63
    # 13.1 branch: vulnerable < 13.1.2.57, fixed >= 13.1.2.57
    $fixed130 = [System.Version]'13.0.3.63'
    $fixed131 = [System.Version]'13.1.2.57'

    # Determine branch
    if ($ver.Minor -eq 0) {
        if ($ver -ge $fixed130) {
            Write-Host "PATCHED - Version $verStr is at or above the fixed 13.0.3 build ($fixed130)."
            exit 0
        } else {
            Write-Host "VULNERABLE - Version $verStr is below the fixed 13.0.3 build ($fixed130). Update to 13.0.3 (build 13.0.3.63) per KB4948."
            exit 1
        }
    } elseif ($ver.Minor -eq 1) {
        if ($ver -ge $fixed131) {
            Write-Host "PATCHED - Version $verStr is at or above the fixed 13.1.2 build ($fixed131)."
            exit 0
        } else {
            Write-Host "VULNERABLE - Version $verStr is below the fixed 13.1.2 build ($fixed131). Update to 13.1.2 (build 13.1.2.57) per KB4948."
            exit 1
        }
    } elseif ($ver.Minor -ge 2) {
        Write-Host "PATCHED - Version $verStr is a newer minor release assumed to include the fix."
        exit 0
    } else {
        Write-Host "UNKNOWN - Unexpected version branch: $verStr. Verify manually against KB4948."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}