Multi-Factor Authentication Bypass in Veeam Software
CVE-2026-107671

8.5HIGH

Key Information:

Vendor

Veeam
Status
One
Vendor
CVE Published:
27 October 2026

What is CVE-2026-107671?

A vulnerability exists in Veeam Software allowing an attacker, who possesses valid Administrator credentials, to disable multi-factor authentication globally. This action can be executed prior to completing the MFA verification process, granting unauthorized access to sensitive resources and posing a significant security risk.

Affected Version(s)

ONE 13.1 <= 13.1.0.7233

References

https://www.veeam.com/kb4951

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.