Veeam ONE CVE-2026-107671

Exploitation requires the attacker to already possess valid Veeam ONE Administrator credentials (CVSS PR:H) and network access to the Veeam ONE interface (AV:N). The specific mechanism is the global MFA-disable capability being usable before the attacker's own MFA verification is completed, allowing the second factor to be turned off and bypassed. The key limiting factor is the administrative-privilege prerequisite: this is not exploitable by unauthenticated or low-privileged users, so it functions as an MFA-defeat/defense-in-depth bypass rather than an initial-access vector. No user interaction is required (UI:N). Affected: Veeam ONE 13.1 up to and including build 13.1.0.7233.

This is a high-CVSS (8.5, CVSS 4.0) authentication-weakness issue (CWE-288) whose real-world urgency is tempered by its precondition: the CVSS vector PR:H confirms the attacker must already hold valid Administrator credentials, and the description matches this - MFA is disabled globally by an authenticated administrator before MFA verification completes. The vuln.today decision label is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the provided data, so there is no signal of active or widespread exploitation. No PoC or exploit reference is present in the input. The practical risk is therefore an MFA-defeat/privilege-retention or second-factor-bypass concern against accounts that are already administrative - valuable to an attacker who has phished or stolen admin credentials and wants to neutralize MFA as a safety net, but not a remote-unauthenticated mass-exploitation scenario. VI:H/VC:H reflect that defeating MFA undermines the integrity and confidentiality of the authentication control itself. Note the tension: network vector (AV:N) and low complexity (AC:L) look severe, but PR:H sharply narrows the realistic attacker set - this is a defense-in-depth failure, not an initial-access vulnerability.

An attacker who has already obtained valid Veeam ONE Administrator credentials (e.g. via phishing or credential reuse) logs in and, before completing the multi-factor verification step, invokes the global MFA-disable function, turning off MFA for the deployment and bypassing the second factor. This lets the attacker retain persistent administrative access and strip the MFA protection that would otherwise guard other admin accounts. No public exploit identified at time of analysis; the attack is network-reachable (AV:N) with low complexity (AC:L) but requires pre-existing administrative privileges (PR:H).