Veeam Backup & Replication EUVD-2026-111121

Exploitation targets the CDP (Continuous Data Protection) Coordinator Service of Veeam Backup & Replication, so the affected deployment must be running a vulnerable version (13.0 before 13.0.3, or 13.1 before 13.1.2) with that coordinator service network-reachable to the attacker. Per CVSS the attacker needs no authentication (PR:N) and no user interaction (UI:N), but the vector also carries AT:P, indicating an attack requirement/precondition beyond the attacker's control exists - however, the description does not state what that precondition is, so it cannot be characterized further from available sources. The primary limiting factor is exposure of the CDP Coordinator Service to untrusted networks; installations not using CDP or with the service restricted to trusted segments reduce reachable attack surface.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated authorization bypass, and the vendor-published CVSS of 9.1 aligns with high integrity and availability impact on both the vulnerable and subsequent systems (VI:H/VA:H/SI:H/SA:H) - consistent with CWE-636 (failure to fail securely / fail-open). The vuln.today decision label is 'act_now' and a vendor patch exists, which together argue for immediate remediation. Two key exploitation signals are MISSING from the input and should temper certainty: there is no EPSS probability provided and no CISA KEV listing, so widespread or confirmed active exploitation cannot be asserted. One nuance worth flagging: the 4.0 vector carries AT:P (attack requirements present), meaning exploitation depends on some condition beyond the attacker's control, yet the description does not state what that condition is - the trigger is not described in the available sources, so the practical ease of exploitation cannot be fully confirmed from this data. Confidentiality impact is rated none (VC:N), so this is an integrity/availability threat (unauthorized actions and potential disruption of a backup platform) rather than a data-exposure one.

A remote, unauthenticated attacker with network access to the CDP Coordinator Service of a Veeam Backup & Replication deployment sends a crafted request that the service fails to properly authorize, letting the attacker perform privileged actions reserved for authenticated operators. Because the flaw affects a backup-coordination component, successful abuse could let the attacker tamper with or disrupt backup and replication operations. No public exploit identified at time of analysis; the specific trigger is not described in the available sources.