{"id":"CVE-2026-107671","kind":"vulnerability","aliases":["CVE-2026-107671"],"related":[],"title":"Administrator MFA bypass by disabling MFA globally before verification","description":"A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.","summary":"Veeam ONE 13.1: an attacker with valid Administrator credentials can disable MFA globally before completing MFA verification, so the second factor no longer protects admin logins.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam ONE","fixed":["13.1.0.7940 (13.1 P1)"],"affected":">= 13.1, <= 13.1.0.7233","ecosystem":"vendor"}],"ecosystems":[],"tags":["mfa","other","self-hosted","veeam","veeam-one"],"not_affected_if":["veeam-one-12","veeam-one-13.0"],"how_to_check":"In the Veeam ONE client, check Help > About for the build number. Builds 13.1.0.7233 or earlier in the 13.1 line are vulnerable. 13.1.0.7940 (13.1 P1) or later is fixed. 13.0.x and 12.x are not affected.","fix":"Install Veeam ONE 13.1 P1 (build 13.1.0.7940) per KB4951.","status":"open","published_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:26+00:00","updated_at":"2026-10-27T17:39:23+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-27T17:34:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Administrator MFA bypass by disabling MFA globally before verification","impact":"high","summary":"An attacker holding valid Administrator credentials can disable multi-factor authentication globally before completing the MFA check. The result is that the second factor no longer protects administrator logins.","category":"other","nicknames":[],"who_cares":["self-hosted"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker with admin password keeps full admin access without second factor","analyst_note":"Identify the affected product and vendor advisory from the NVD entry; the description names no product, so the vendor and fixed versions are unknown.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":3267,"output_tokens":314,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor advisory from the NVD entry; the description names no product, so the vendor and fixed versions are unknown.","search":"'-107671':12A,15A '-2026':11A,14A '13.1':29B 'admin':51B 'administr':1A,34B,60C 'allow':55C 'attack':31B,57C 'authent':67C 'bypass':3A,63C 'complet':41B,73C 'credenti':35B,61C 'cve':10A,13A 'disabl':5A,37B,69C 'factor':47B,66C 'global':7A,39B,71C 'host':22B 'login':52B 'longer':49B 'mfa':2A,6A,18B,38B,42B,74C 'multi':65C 'multi-factor':64C 'one':17A,26B,28B 'protect':50B 'second':46B 'self':21B 'self-host':20B 'valid':33B,59C 'veeam':16A,23B,25B,27B 'veeam-on':24B 'verif':9A,43B,75C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":"Teams running Veeam ONE 13.1 (build 13.1.0.7233 or earlier) with MFA enabled for administrators. Exploitation needs valid Administrator credentials, so the risk is a stolen or phished admin password that MFA was meant to cover. Veeam ONE 13.0.x and 12.x are not affected.","tier":"B","verified":{"fix":{"at":"2026-10-27T17:39:23Z","by":"analyst","run_id":905},"products":{"at":"2026-10-27T17:39:23Z","by":"analyst","run_id":905},"how_to_check":{"at":"2026-10-27T17:39:23Z","by":"analyst","run_id":905},"who_affected":{"at":"2026-10-27T17:39:23Z","by":"analyst","run_id":905}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107671","severity":null,"published_at":"2026-10-27T17:16:56+00:00","modified_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107671:905","url":null,"severity":null,"published_at":"2026-10-27T17:39:23+00:00","modified_at":"2026-10-27T17:39:23+00:00","first_seen_at":"2026-10-27T17:39:23+00:00","fetched_at":"2026-10-27T17:39:23+00:00","note":"Identified as Veeam ONE via vendor KB4951 (published today); affected 13.1.0.7233 and earlier 13.1 builds, fixed in 13.1 P1 build 13.1.0.7940. No exploitation or PoC found; community search not run (new, vendor-only)."}],"documents":[{"id":7202,"url":"https://www.veeam.com/kb4951","title":"KB4951: Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1","kind":"advisory","source":"analyst","text":"CVE-2026-107671: attacker with valid Administrator credentials can bypass MFA by disabling it globally before completing MFA verification. High, CVSS v4.0 8.5. Affected: Veeam ONE 13.1.0.7233 and all earlier 13.1 builds; 13.0.x and 12.x not affected. Fixed in Veeam ONE 13.1 P1 (build 13.1.0.7940). Reported through HackerOne.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}