Veeam Backup & Replication authorization bypass in CDP Coordinator Service

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

• Veeam Backup & Replication on Windows-based deployments and Veeam Software Appliance: 13.1.1.18 and all earlier 13.1 builds are affected. The vendor confirms that the issue is fixed starting with 13.1.2 build 13.1.2.57.
• Veeam Backup & Replication on Windows-based deployments and Veeam Software Appliance: 13.0.2.29 and all earlier 13.0 builds are affected. The vendor confirms that the issue is fixed starting with 13.0.3 build 13.0.3.63.
• The vendor states that older versions, such as the 12.x branch, are not affected. The record does not establish the status of other parallel branches outside this scope.

The flaw is an authorization enforcement failure in the CDP Coordinator Service, classified as CWE-636, which covers unsafe handling when a security check fails. This classification is consistent with an authorization decision failing open, but the record and vendor advisory do not disclose the exact implementation. The attacker does not need authentication and reaches the component over the network; the supplied attack characteristics indicate low complexity and no user interaction. The supplied vector also indicates an additional attack requirement, but the available material does not describe what that requirement is. The documented outcome is an authorization bypass with high integrity and availability impact, while no confidentiality impact is recorded. The exact request, protocol, endpoint, and authorization condition being bypassed remain unknown.

• Reachability: Network.
• Authentication: Not required.
• User interaction: Not required.
• Complexity: Low; the supplied attack characteristics also indicate an additional requirement that has not been described.
• Exploitation status: The supplied record does not mark the issue as known exploited or identify a public exploit, and the vendor advisory does not confirm active exploitation. Treat exploitation status as unknown rather than safe.

The flaw may allow an unauthenticated attacker to perform unauthorized operations through the CDP Coordinator Service. The record indicates high impact to integrity and availability, but no impact to confidentiality. Realistic consequences may include unauthorized changes to service operation or disruption of dependent workflows, although the specific operations available to an attacker are not public. The available evidence does not indicate impact beyond the affected system scope, so compromise of other systems should not be inferred.

Affected deployments may allow unauthorized operations supported by the CDP Coordinator Service. Depending on the operation reached, this could result in unauthorized changes to service state or disruption of workflows that depend on the service. Organizations should prioritize identifying affected builds, applying the vendor fix, and validating expected service behavior afterward. The record does not establish data disclosure, a specific breach, or a named attacker campaign, so those outcomes should not be assumed.

1. Identify the deployed branch and update Veeam Backup & Replication to the vendor-confirmed fixed build: update the 13.1 branch to 13.1.2 build 13.1.2.57, or update the 13.0 branch to 13.0.3 build 13.0.3.63.
2. Apply the update to both Windows-based deployments and Veeam Software Appliance deployments when they are running affected branches.
3. After updating, verify the installed version and build on the host and confirm that the CDP Coordinator Service is running from the fixed installation.
4. Review the service for unexpected activity during the period in which the deployment used an affected build. If unauthorized changes or disruption are found, handle the event as a separate security incident.
5. No specific temporary mitigation is confirmed in the sources reviewed. Do not substitute unsupported configuration changes for the vendor update.

1. Inventory Veeam Backup & Replication installations on Windows and Veeam Software Appliance, recording the exact version and build for each deployment.
2. Compare each installation with the affected branches and vendor-confirmed fixed builds listed in affected_summary.
3. Identify deployments containing the CDP Coordinator Service and determine whether the service is reachable from untrusted networks. The advisory does not specify an endpoint, port, or configuration key, so these details should not be guessed.
4. Review access and service-activity logs for unauthenticated requests, unexpected state changes, or activity inconsistent with the service's expected behavior while a deployment was on an affected build. This is precautionary review, not a vendor-confirmed indicator of compromise.
5. Preserve relevant evidence and investigate anomalies separately; the absence of log evidence does not prove that a deployment was safe.