Veeam ONE 13.1 Patch 1 Fixes MFA Bypass by Administrators
Tech GuruQuick Answer
Veeam KB4951 fixes CVE-2026-107671 in Veeam ONE 13.1 Patch 1 build 13.1.0.7940. Inventory affected builds and administrators, upgrade, validate MFA and privileged-change controls, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Veeam ONE 13.1 servers, exact builds, Administrator accounts, MFA state, console exposure, owners, and recent privileged changes. Confirm the affected 13.1 build and valid Administrator-credential prerequisite; do not describe the issue as an unauthenticated MFA bypass. Install Veeam ONE 13.1 Patch 1 build 13.1.0.7940 or a later supported release. Confirm the build, test MFA enrollment and enforcement, review MFA-disable and administrator activity where warranted, validate monitoring workflows, and retain evidence.
Last verified: 2026-10-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Veeam ONE 13.1 |
|---|---|
| Advisory | KB4951 |
| CVE | CVE-2026-107671 |
| Authoritative release date | 2026-10-27 00:00:00 UTC |
| Authority revision date | 2026-10-27 00:00:00 UTC |
| Affected versions | Veeam ONE 13.1.0.7233 and all earlier 13.1 builds; Veeam says 13.0.x and 12.x are not affected. |
| Fixed version | Veeam ONE 13.1 Patch 1 build 13.1.0.7940 |
| CVSS base score | 8.5 (CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Veeam does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Veeam fixed a path that allows an attacker with valid Administrator credentials to disable MFA globally before completing MFA verification.
What To Validate Now
- Inventory. Inventory Veeam ONE 13.1 servers, exact builds, Administrator accounts, MFA state, console exposure, owners, and recent privileged changes.
- Establish applicability. Confirm the affected 13.1 build and valid Administrator-credential prerequisite; do not describe the issue as an unauthenticated MFA bypass.
- Remediate. Install Veeam ONE 13.1 Patch 1 build 13.1.0.7940 or a later supported release.
- Validate. Confirm the build, test MFA enrollment and enforcement, review MFA-disable and administrator activity where warranted, validate monitoring workflows, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve relevant audit evidence before rotating credentials or changing MFA state when investigation is justified; patching does not determine whether prior administrator access occurred.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
