Vulnerability in Veeam ONE

[ Description ]Official description

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

[ Fixes ]Fixes and patches

• Security bulletin: Veeam kb4957Vendor patch or bulletin · CERT-FR · veeam.com/kb4957, cited by CERT-FR CERTFR-2026-AVI-1399
• Security bulletin: Veeam kb4951Vendor patch or bulletin · CERT-FR · veeam.com/kb4951, cited by CERT-FR CERTFR-2026-AVI-1399
• Security bulletin: Veeam kb4948Vendor patch or bulletin · CERT-FR · veeam.com/kb4948, cited by CERT-FR CERTFR-2026-AVI-1399

[ Advisories ]Government CERT advisories

• CERT-FR28 Oct 2026CERTFR-2026-AVI-1399

  Multiple vulnerabilities in Veeam products Translated from French

  Multiple vulnerabilities have been discovered in Veeam products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

  CVE-2026-108142CVE-2025-64394CVE-2026-106077+6 more CVEs
• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4213

  Veeam ONE: Vulnerability allows bypassing security measures Translated from German

  CVE-2026-107671

[ References ]References

• www.veeam.com/kb4951