Is CVE-2026-107671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107671 being exploited in the wild.

How severe is CVE-2026-107671?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Veeam ONE 13.1.0.7233 and all earlier 13.1 builds.

Is there a fix for CVE-2026-107671?

Yes: fixed in Veeam ONE 13.1 P1 (build 13.1.0.7940). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107671 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107671?

Check whether you run Veeam ONE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107671: Veeam ONE MFA bypass with administrator credentials

CVE-2026-107671 · Severity: info · Published 2026-10-27

Veeam ONE, a monitoring and reporting tool used to manage backup infrastructure, contains a flaw that allows an attacker with administrator credentials to disable multi-factor authentication globally before completing their own MFA verification. This enables an attacker with compromised admin credentials to gain unfettered access to the system by disarming its strongest security control.

Vendors: Veeam.

Quick answers

Is CVE-2026-107671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107671 being exploited in the wild.
How severe is CVE-2026-107671?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Veeam ONE 13.1.0.7233 and all earlier 13.1 builds.
Is there a fix for CVE-2026-107671?: Yes: fixed in Veeam ONE 13.1 P1 (build 13.1.0.7940). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107671 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107671?: Check whether you run Veeam ONE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Veeam ONE 13.1 P1 (build 13.1.0.7940)

Technical details

An authenticated administrator can disable MFA globally in Veeam ONE before completing their own multi-factor authentication verification, circumventing the MFA requirement across the entire system. The vulnerability requires valid administrator credentials and network access, and results in high impact to confidentiality and integrity. A patch is available in Veeam ONE 13.1 P1.

Affected products

Veeam ONE 13.1.0.7233 and all earlier 13.1 builds

Timeline

2026-10-27: disclosed
2026-10-27: advisory

References

https://www.veeam.com/kb4951

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.