Article
Veeam Fixes Five Flaws, One Critical, in Backup & Replication and Veeam ONE
On 27 October 2026 Veeam fixed CVE-2026-108142, a critical authorization bypass in Backup & Replication 13, and four more flaws. See the builds to…
Read more
Vulnerability
Veeam ONE MFA bypass (CVE-2026-107671)
A multi-factor authentication bypass in Veeam ONE 13.1.
- CVE ID
- CVE-2026-107671
- CVSS
- 8.5 High (CVSS v4.0, Veeam); NVD has no score of its own yet
- Affected product
- Veeam ONE 13.1
- Exploited
- Unknown
- Published
- 27 October 2026 (Veeam advisory KB4951 and NVD record)
In short
CVE-2026-107671 is a multi-factor authentication bypass in Veeam ONE 13.1. Veeam says an attacker with valid Administrator credentials can disable MFA globally before completing MFA verification. It is fixed in Veeam ONE 13.1 P1 (build 13.1.0.7940).
- CVECVE-2026-107671
- ProductVeeam Veeam ONE 13.1
- Fix Steps4actions listedCheck the build · Install 13.1 P1
What it allows
Veeam describes CVE-2026-107671 as "a vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification." It rates the flaw High, with a CVSS v4.0 score of 8.5. The vector is AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Veeam says it was reported through HackerOne.
Veeam gives no exploit detail. The article does not say how the attacker disables MFA or whether the change leaves a trace.
What It Means for Veeam ONE Administrators
This is our reading, not a statement from Veeam. The attacker already has an Administrator password, which the vector marks as high privileges required. The flaw removes the second factor for that account, and for everyone, because MFA is switched off globally. It does not hand out an Administrator account by itself.
The vector rates the impact on confidentiality and integrity of Veeam ONE as high and on availability as none. If you find multi-factor authentication switched off and nobody on your team did it, treat the Administrator account as compromised. Change its password and review what it did.
What Our Checks Showed
Exploit signals
- CISA KEVNot seenThe catalog release of 27 October 2026 does not list the flaw27 Oct
- Exploitation reported by VeeamUnknownThe advisory describes no exploitation27 Oct
Verdict Not in CISA KEV; Veeam describes no exploitation
Veeam fixed four more flaws in Backup & Replication and the Linux agent on the same day. The critical one is CVE-2026-108142, and our news post on the October Veeam fixes covers all five.
Who is affected
Veeam lists Veeam ONE 13.1.0.7233 and all earlier 13.1 builds as affected. Veeam adds: "Older versions (e.g., 13.0.x and 12.x) are not affected." NVD's record lists 13.1 up to and including 13.1.0.7233.
Veeam fixed the flaw in Veeam ONE 13.1 P1 (build 13.1.0.7940). Veeam describes the fix in KB4951.
Timeline
- 27 Oct 2026
Veeam publishes KB4951 and Veeam ONE 13.1 P1 (build 13.1.0.7940). NVD publishes the CVE record at 17:16 UTC with status Received and Veeam's score of 8.5.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
What to do
-
Check the build
Note the build of every Veeam ONE 13.1 server. 13.1.0.7233 and earlier 13.1 builds are affected.
-
Install 13.1 P1
Update to Veeam ONE 13.1 P1 (build 13.1.0.7940). Veeam's article names no workaround.
-
Confirm MFA is on
After patching, check that multi-factor authentication is still enabled for Veeam ONE.
-
Treat MFA switched off as a warning
If MFA is off and nobody on your team switched it off, assume someone knows an Administrator password. Reset it and review what the account did.
Questions
Which Veeam ONE builds does CVE-2026-107671 affect?
Veeam ONE 13.1.0.7233 and all earlier 13.1 builds. Veeam fixed it in Veeam ONE 13.1 P1 (build 13.1.0.7940).
Are Veeam ONE 13.0 and 12.x affected?
No. Veeam's note says older versions, for example 13.0.x and 12.x, are not affected.
Does the attacker need a password?
Yes. Veeam describes an attacker with valid Administrator credentials who disables MFA globally before completing MFA verification.
Is CVE-2026-107671 exploited?
The CISA KEV catalog release of 27 October 2026 does not list it, and Veeam's advisory describes no exploitation.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 82 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.