{"id":"CVE-2026-108142","published":"2026-10-27T17:16:57Z","modified":"2026-10-28T14:47:07Z","title":"A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service","vendor":"Veeam","product":"Backup and Replication","tier":"core","eol":null,"description":{"text":"A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the CDP Coordinator Service, a component of Veeam Backup and Replication, lets an attacker bypass authorization checks on that service. The attack requires only network access to the service, with no authentication, no user interaction and no special configuration, and it can be used to affect the integrity and availability of the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:59Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.00401,"percentile":0.34251,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ae35d945cba1d70e2bf3a79","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ae20c338ef6b2d900217a8b","created":"2026-10-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-636","name":"Not Failing Securely"}],"references":[{"url":"https://www.veeam.com/kb4948","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-111121","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111121","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108142","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.85,"detail":"percentile 0.3425"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}