If your IT provider set up Veeam to back up your servers, the backup server itself just got a critical update. On Oct. 27, 2026, Veeam fixed a bug in Veeam Backup & Replication 13 that lets an attacker with no login get past the permission checks on one of its services. Veeam rates it critical, 9.1 out of 10.
There are no reports of attacks using it yet. Veeam's own advisory explains why that isn't a reason to wait: once a fix is published, "attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments." For law firms, accounting practices, engineering offices, clinics and nonprofits, the backup server is the thing you're counting on if ransomware ever hits, so it should be the first box patched, not the last.
What's been reported
- The bug. In KB4948, Veeam describes CVE-2026-108142 as "a vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service." CDP is Veeam's continuous data protection feature. It affects both Windows-based installs and the Veeam Software Appliance.
- Which versions. Backup & Replication 13.1.1.18 and earlier 13.1 builds, and 13.0.2.29 and earlier 13.0 builds, are affected. The fix is in 13.1.2.57 or 13.0.3.63. Veeam says older versions such as 12.x are not affected by this bug.
- Two smaller fixes in the same update. Veeam also fixed two medium-rated bugs (CVE-2026-108140 and -108141) that let a user with the Restore Operator role write files to any folder on the backup server, and its release notes list a high-rated local privilege bug in Veeam Agent for Linux.
- What isn't known. Veeam hasn't published technical details or said which network port is involved. France's health-sector CERT says no public proof of concept was available as of Oct. 28, and the bug is not in CISA's Known Exploited Vulnerabilities catalog.
Why the backup server matters more than most
When a small business gets hit with ransomware, the question that decides how bad the week goes is whether the backups survived. A backup server holds copies of everything, usually has passwords for every machine it backs up, and can delete or overwrite those copies. That makes it one of the most valuable systems on your network to an attacker and one of the easiest to forget, because it runs quietly in the background and nobody logs into it unless something breaks.
Veeam says the 13.1 update rolls out automatically through Veeam Updater over time. "Gradually" is the important word. Don't assume yours already has it; check.
Clear takeaway
Ask whoever manages your backups to confirm in writing which Veeam version you run, and if it's 13.0 or 13.1, to install 13.1.2.57 or 13.0.3.63 this week and test a restore afterward.
What to do this week
- Find out if you use Veeam. If you don't know, ask your IT provider. Many small offices have it without realizing, because it came with a server or a managed backup plan.
- Get the exact version. The build number shows in the Veeam console's About screen. If it starts with 13.0 or 13.1, you need the update. If it's 12.x, this bug doesn't apply, but ask when that version stops getting security fixes.
- Install the fix. Use Veeam Updater or the 13.1 installation media from Veeam's My Account portal. Don't wait for the automatic rollout.
- Keep the backup server off the open network. It shouldn't be reachable from the internet, and ideally only your IT provider's admin machines should reach its management ports. If it's joined to the same Windows domain as everything else, ask whether it should be.
- Check who has access. Review the accounts with Veeam roles, including Restore Operator. Remove former staff and old vendor accounts, and turn on multi-factor authentication for the console if your version supports it.
- Make sure one copy can't be erased. Ask for at least one backup copy that's offline or immutable (locked so it can't be changed or deleted for a set time), so a hacked backup server can't wipe everything.
- Test a restore. After patching, restore a real file or a whole machine and time it. A backup you've never restored from is a guess.
How Brotherly Technology can help
Brotherly Technology can check your Veeam version, install the update, lock down who can reach the backup server, set up an immutable copy and run a test restore with you watching. If you're not sure who manages your backups or when they were last tested, call us and we'll find out this week.