Detections
Analytics
Veeam Backup and Replication 13.0.x < 13.0.3.63 / 13.1.x < 13.1.2.57 Multiple Vulnerabilities (kb4948)
critical Nessus Plugin ID 380284
Synopsis
The Veeam backup application installed on the remote host is affected by multiple vulnerabilities.Description
The version of Veeam Backup and Replication installed on the remote host is 13.0.x prior to 13.0.3.63, or 13.1.x prior to 13.1.2.57. It is, therefore, affected by multiple vulnerabilities:- A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. (CVE-2026-108142)
- A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. (CVE-2026-108140)
- A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. (CVE-2026-108141)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Veeam Backup and Replication version 13.0.3.63, 13.1.2.57 or later.See Also
Plugin Details
Severity: Critical
ID: 380284
File Name: veeam_backup_and_replication_kb4948.nasl
Version: 1.1
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 11/13/2026
Updated: 11/13/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.12
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-108142
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4
Risk Factor: Critical
Base Score: 9.1
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Vulnerability Information
CPE: cpe:/a:veeam:backup_and_replication
Required KB Items: installed_sw/Veeam Backup and Replication
Patch Publication Date: 8/25/2026
Vulnerability Publication Date: 10/27/2026