Veeam shipped a platform-wide update on 27 October covering the backup server, the software appliance, every agent, monitoring and the major hypervisor plug-ins — and then repackaged the Windows ISO on 6 November. This bulletin covers VBR 13.1.2.57 and the four CVEs it closes, the ISO change, VBR 12.3.2.4934 for anyone still on version 12, Veeam Backup for Microsoft 365 8.6 against the Exchange Web Services retirement, Veeam ONE 13.1.0.7940, Recovery Orchestrator 13.1 and the new Intelligent ResOps offering.

Patch VBR 13.1 first: CVE-2026-108142 is a 9.1

VBR 13.1.2.57 closes four vulnerabilities. One of them needs no credentials at all:

• CVE-2026-108142 — Critical, 9.1. Unauthenticated authorization bypass in the CDP Coordinator Service.
• CVE-2026-105477 — High, 7.3. Local privilege escalation in the managed Veeam Agent for Linux.
• CVE-2026-108140 — Medium, 5.9. NAS restore path traversal.
• CVE-2026-108141 — Medium, 5.9. NAS restore path traversal.

The critical one sits in the CDP Coordinator Service, so continuous data protection environments carry the most exposure. The Linux agent issue deserves a second look if you manage agents centrally across a customer estate.

The release also refreshes bundled third-party components: OpenSSL 3.5.8, .NET Runtime 10.0.12 and PowerShell 7.6.6.

Installing fresh? Use the November ISO, not the October one

On 6 November Veeam repackaged the VBR 13.1.2.57 Windows installation ISO to address a Linux kernel vulnerability, CVE-2026-98432. The build number did not change.

Use the repackaged ISO for new installations and migrations. The original October ISO still carries the kernel issue, and because the version string looks identical, this is an easy one to get wrong from a file already sitting on a software share. Check the date on the media before you build anything new.

How to take the 27 October update

Every major component moved on the same day:

• Veeam Backup & Replication — 13.1.2.57
• Veeam Software Appliance — 13.1.2.57
• Veeam ONE — 13.1.0.7940
• Veeam Agent for Windows — 13.1.2.812
• Veeam Agent for Linux — 13.1.2.11
• Veeam Agent for Mac — 13.1.2.4
• Veeam Backup for Microsoft 365 — 8.6.0.5011
• Nutanix AHV Plug-in — 13.10.1.4
• HPE Morpheus VM Essentials Plug-in — 13.2.1.5
• oVirt KVM Plug-in — 13.8.1.2

A few operational notes before you start:

• Read the cumulative patch release notes first. This is a maintenance release built from reported customer issues and defects.
• Plan for a possible server reboot.
• Veeam Software Appliance installations update directly through the appliance.
• Windows VBR 13.1 deployments receive updates through Veeam Updater as the update repository rollout progresses. If you need it sooner, pull the media from the customer portal.
• If you run several Veeam components, validate compatibility and upgrade sequencing before you deploy anything.

Still on version 12? 12.3.2.4934 is out

Veeam also released VBR 12.3.2.4934 for organisations that have not yet moved to VBR 13. Review the release notes and cumulative fixes, validate your existing jobs and repository integrations, check agent and plug-in compatibility, and test backup, restore and configuration backup after patching.

One practical catch: according to Veeam’s download listing, the full installation media for this build requires a support case. Raise it before the maintenance window rather than inside it.

The Microsoft 365 deadline you did not put in the calendar

Microsoft began retiring Exchange Web Services in Exchange Online on 1 October 2026. Veeam Backup for Microsoft 365 8.6 is where you want to be on the other side of that.

If you protect Microsoft 365 tenants, work through this list:

• Check your current Veeam Backup for Microsoft 365 version and configuration.
• Upgrade to 8.6 — current build 8.6.0.5011.
• Verify the required Microsoft Graph permissions.
• Validate Exchange Online backup jobs after the transition.
• Watch for backup job failures and authentication errors.

For an MSP running this across many tenants, the failure mode is quiet: jobs that authenticate today stop authenticating later, one tenant at a time. Version 8.6 also adds PowerShell cmdlets for remediating JET-based repositories, object storage repository maintenance mode through PowerShell and the REST API, Exchange Server Subscription Edition support, preservation of SharePoint site permissions and members when restoring a site to a new location, and better performance on large SharePoint sites and Exchange mailboxes.

Veeam ONE 13.1 and what else landed

Veeam ONE 13.1.0.7940 came in the 27 October update. The 13.1 platform adds support for Scale Computing HyperCore, HPE Morpheus VM Essentials, Sangfor aSV and Citrix Xen, plus enhanced dashboards, alarms and reporting, REST API support for additional hypervisors, SAML single sign-on with multiple identity providers, role-based access control and a dedicated Backup Administrator role.

Recovery Orchestrator 13.1, released in July, remains central to the current portfolio: cleanroom recovery for isolated recovery validation, cross-platform recovery from VMware vSphere backups to Hyper-V, Hyper-V recovery to Azure Cloud Plans, read-only repository access for recovery planning and Veeam Updater integration.

Intelligent ResOps (iResOps) was October’s strategic announcement, aimed at data resilience through intelligence, visibility and operational response. iResOps for Microsoft 365 is generally available as an add-on to Veeam Data Cloud for Microsoft 365; iResOps for Veeam Data Platform and for Okta are both in private preview.

Fixes worth knowing about in 13.1.2

Several of the resolved issues matter in production: high CPU and memory on PostgreSQL configuration databases with large backup sets; high CPU and service responsiveness during external repository resynchronisation; an increased SOAP timeout for large VMware environments; VeeamZIP and clustered VM restore issues on Hyper-V; guest processing failures on Proxmox VE after upgrade; orphaned Nutanix AHV configuration records during repeated cluster rescans; backup ownership and orphaned file handling on object storage; restore point enumeration and catalog performance on tape; a Google Cloud large disk restore issue involving fully allocated disks; Azure Instant Recovery helper appliance deployment; and a non-root restore credential issue in Linux file-level recovery on Ubuntu 26.04.

Need help sequencing the upgrade?

Arrosoft manages Veeam environments for partners and their customers across APAC and North America. If you would like us to audit which builds your estate is actually running, confirm which of the four CVEs you are exposed to, check whether your Microsoft 365 tenants are ready for the EWS retirement, and plan the upgrade order across backup server, agents, monitoring and plug-ins, get in touch.

Full detail: KB4948 — vulnerabilities resolved in Veeam Backup & Replication 13.1.2, KB4966 — CVE-2026-98432 impact statement, KB4951 — vulnerabilities resolved in Veeam ONE 13.1 Patch 1, and KB4738 — release information for Veeam Backup & Replication 13 and updates.