Live › vulnerability › CVE-2026-107671
Go to dashboardVeeam ONE 13.1: an attacker with valid Administrator credentials can disable MFA globally before completing MFA verification, so the second factor no longer protects admin logins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Teams running Veeam ONE 13.1 (build 13.1.0.7233 or earlier) with MFA enabled for administrators. Exploitation needs valid Administrator credentials, so the risk is a stolen or phished admin password that MFA was meant to cover. Veeam ONE 13.0.x and 12.x are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam ONE | vendor | >= 13.1, <= 13.1.0.7233 | 13.1.0.7940 (13.1 P1) |
13.1.0.7233 or earlier in the 13.1 line are vulnerable. 13.1.0.7940 (13.1 P1) or later is fixed. 13.0.x and 12.x are not affectedInstall Veeam ONE 13.1 P1 (build 13.1.0.7940) per KB4951.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
This page as .md · .json · in your agent: get_signal("CVE-2026-107671")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.