Vulnerabilities

Veeam published two advisories on October 27, 2026. KB4948 fixes CVE-2026-108142, a critical authorization bypass in Veeam Backup & Replication (VBR) 13 that needs no login. KB4957 fixes CVE-2026-106076, a critical SQL injection in Veeam Backup for Microsoft 365 that reaches across tenants and ends in code execution. A day later Juniper released bulletin JSA112183 with 18 fixes for Session Smart Router and Session Smart Conductor, two of them scored CVSS 9.8 and exploitable without credentials.

You are affected if you run VBR 13.0.2.29 or earlier 13.0 builds, or 13.1.1.18 or earlier 13.1 builds; Backup for Microsoft 365 8.5.0.1014 or earlier version 8 builds; or any Session Smart Router or Conductor release below 7.0.5, 7.1.7 or 7.2.3. Neither vendor knows of exploitation yet. Backup servers are still a target worth moving on quickly: CVE-2024-40711, an earlier VBR flaw, ended up in CISA's Known Exploited Vulnerabilities (KEV) catalog after the Akira, Fog and Frag ransomware crews used it to get into backup servers before encrypting.

How the Veeam flaws work

The CDP Coordinator service runs on the VBR backup server. It coordinates Continuous Data Protection (CDP), Veeam's near-continuous replication of virtual machines, and the I/O filters on hypervisor hosts talk to it over the network. Veeam describes CVE-2026-108142 only as letting an unauthenticated attacker "bypass authorization" on that service, and the CVE record classes the bug as CWE-636, "Not Failing Securely": when an authorization check cannot reach a clean decision, the service lets the request through instead of refusing it.

The CVSS 4.0 vector (score 9.1) rates the impact as high for integrity and availability on the backup server and on systems beyond it, and none for confidentiality. In plain terms, an attacker who can reach the service can change or break what CDP is doing, which could mean corrupting replicas or stopping the protection you would fail over to. The vector also sets Attack Requirements to "present", so some deployment condition has to hold first; Veeam has not said what it is. The flaw affects Windows installs and the Veeam Software Appliance. Version 12 is not affected, and Veeam has published no exploit details.

CVE-2026-106076 (CVSS 4.0 score 9.0) sits in the organization transfer feature of Backup for Microsoft 365, which moves a protected Microsoft 365 organization from one backup server to another. During a transfer the source server accepts input from the peer server, and that input reaches a SQL query against the source's configuration database without being sanitised. A malicious or compromised peer can therefore read and write configuration data that belongs to other tenants on the same server and run code as the PostgreSQL service account. Service providers that host many customer tenants on one server carry the most risk.

How the Juniper flaws work

Session Smart Router is Juniper's software-defined WAN router, and Session Smart Conductor is the central server that provisions and manages a fleet of them. CVE-2026-103406 (CVSS 3.1 score 9.8) is OS command injection in the Conductor's AutomatedProvisioner. The Conductor uses Salt, a configuration management tool in which each managed device runs a "minion" that identifies itself to a master with a minion ID. The AutomatedProvisioner passes that ID into a shell command without neutralising special characters, so a crafted ID runs commands as root on the Conductor. Juniper's bulletin title places it "during key management", the step where the Conductor handles a new device's key. A root shell on the Conductor reaches every router it manages.

CVE-2026-103409 (also 9.8) is a missing authentication check on an internal endpoint of the router that runs as root. Crafted URL parameters to it give an unauthenticated attacker administrative privileges. Juniper limits the window: the bug works only before the router is onboarded to Mist or a Conductor, and stops working once it is. That puts new routers sitting on a network with a default configuration, and units waiting in a staging area, most at risk.

Juniper found all 18 issues internally. The other 16 are rated lower and cover file read, write and deletion, privilege escalation, information disclosure and denial of service. The CVE records for both critical bugs say there is no workaround.

What to do

Veeam Backup & Replication

Upgrade to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63) or later. Check the running build in the console under Help, then About. The same releases fix two medium path traversal bugs (CVE-2026-108140 and CVE-2026-108141, CVSS 5.9) that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server. If VBR manages Veeam Agent for Linux 13.1 machines, move those agents to 13.1.2 (build 13.1.2.11) as well: CVE-2026-105477 (CVSS 7.3) is a local privilege escalation that affects only managed agents.

Veeam lists no workaround for CVE-2026-108142. Until the upgrade is done, check with a firewall rule that only the hypervisor hosts and proxies running CDP can reach the backup server, and that it is not reachable from user subnets or the internet. This step is our suggestion and not vendor guidance, and it reduces exposure rather than fixing anything.

Veeam Backup for Microsoft 365

Version 8.6 (build 8.6.0.1102) fixes the critical bug, but go straight to 8.6 Patch 1 (build 8.6.0.5011). That build also closes CVE-2026-106078 (CVSS 6.9), which lets an unauthenticated attacker bypass REST API authentication with a forged federation token, and CVE-2025-64394, a local file write during installation. Until then, do not start or accept organization transfers with any server you do not fully control.

Juniper Session Smart

Upgrade every Conductor and router to 7.0.5, 7.1.7 or 7.2.3, or a later release on the same train. Patch the Conductor first, since it is the one with fleet-wide reach. Limit the Salt master ports on the Conductor (TCP 4505 and 4506 by default) to the addresses of your own routers. Onboard new routers to Mist or the Conductor before they connect to any untrusted network, and keep unonboarded units off networks other people use.

Check for compromise

On VBR, review the logs under C:\ProgramData\Veeam\Backup for CDP policy changes, replica errors or stopped policies you cannot explain, and check that recent CDP restore points are intact. On Backup for Microsoft 365, compare the list of organizations and repositories against what you expect, and check the job history for organization transfers you did not start. On a Conductor, run salt-key -L to list accepted minion keys and look for any you do not recognise, plus unexpected processes or cron entries running as root. If anything looks wrong, rebuild the server on a fixed release, then rotate the credentials it stores: hypervisor accounts, Microsoft 365 application secrets and repository passwords.

Backup and management servers deserve the first patch slot

Both vendors' worst bugs sit in systems that control other systems: a backup server that decides what can be restored, and a conductor that pushes configuration to every branch router. Teams tend to patch these last because they are not internet facing and an outage is painful. When an attacker gets into one of them, though, they can reach everything it manages. Put them in the same patch window as your perimeter devices, and keep their management ports reachable only from the hosts that need them.

Our safeguarding and hardening work puts backup and network management servers on a real patch baseline and narrows who can reach them, and our network penetration testing checks whether those management ports can be reached from places they should not be. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: SecurityWeek, Veeam KB4948, Veeam KB4957, IT-Connect, CVE-2026-108142 record, CVE-2026-106076 record, Juniper JSA112183, CVE-2026-103406 record, CVE-2026-103409 record, Canadian Centre for Cyber Security AV26-1101, SecurityOnline, Veeam CDP infrastructure, The Record on CVE-2024-40711.