CVE-2026-108140Published

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave…

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108140 · Microsoft / collected KEV context

cve-program · CVE-2026-108140

https://www.veeam.com/kb4948

Related operational evidence

Explicit CVE identifiers

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave… · Newly collected advisory · 27 Oct 2026