Highest advisory severityHigh 1 vendor · 2 advisories

CVE-2026-107671

Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1

CVE-2026-107671: Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1. Not in the CISA KEV catalog. High advisory severity (CVSS 8.5, Veeam).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Veeam publishes the next one.

VulniPulse checks Veeam's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-107671 key facts

CISA KEV: Not listed (catalog checked Oct 30, 2026)
Highest advisory severity: High
CVSS base score: 8.5 (Veeam)
Fixed releases: Veeam: 13.1
Vendor advisories: 2 from Veeam
VulniPulse record: Published Aug 4, 2026 · Updated Oct 29, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-107671; bulletin-wide values are not repeated here.

Is CVE-2026-107671 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-107671 is not in the CISA KEV catalog (checked Oct 30, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-107671?

Upgrade to a fixed release named by the vendor:

Veeam: 13.1

This vulnerability was fixed starting in the following build: (Veeam)
Veeam ONE 13.1 P1 (build 13.1.0.7940) (Veeam)

Vendor advisory comparison

Veeam

2 advisories

Advisory severityHigh8.5
High [CVE-2026-107671] Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1
KB4951Source published Oct 27, 2026
Vulnerabilities Resolved in Veeam ONE 13.1 P1 KB ID: 4951 Product: Published: 2026-10-27 Last Modified: Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its…
Related products — impact not confirmed
No product details extracted. Check the source bulletin.
Source-reported affected versions
13.1.0.7233
13.0
Source-reported fixed versions
13.1
Mitigation guidance
This vulnerability was fixed starting in the following build:
Veeam ONE 13.1 P1 (build 13.1.0.7940)
Full advisory and evidence Open source bulletin
Advisory severityUnrated
Advisory [CVE-2026-58074 +8] List of Security Fixes and Improvements in Veeam ONE
KB4858Source published Aug 4, 2026
This bulletin covers 9 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
List of Security Fixes and Improvements in Veeam ONE KB ID: 4858 Product: Published: 2026-05-27 Last Modified: Purpose This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam ONE version to a later one. 13.1.0.7940 - BouncyCastle. Cryptography upgraded to version 2.7.0 - brace-expansion upgraded to version 5.0.1 - dompurify upgraded to version 3.4.15 - flatted upgraded to version 3.4.4 - minimatch upgraded to version 10.2.3 - OpenSSL upgraded to version 3.5.9 - picomatch upgraded to versions 2.3.2 and 4.0.4 - uri-js was replaced with fast-uri 3.1.8 13.1.0.7233 Vulnerability Scanner False Positive after…
Related products — impact not confirmed
No product details extracted. Check the source bulletin.
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
13.1.0.7233
3.1.0
Mitigation guidance
List of Security Fixes and Improvements in Veeam ONE KB ID: 4858 Product: Veeam ONE Published: 2026-05-27 Last Modified: 2026-10-27 Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam ONE.
This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam ONE version to a later one.
Vulnerability Scanner False Positive after Update Install After Veeam ONE 13.1.0.7233 is installed, some vulnerability scanners may continue to report the finding because the Veeam ONE Reporter executable remains at version 13.1.0.7034.
This patch does not modify that component, so its version number is unchanged.
1 more entries in the full advisory.
Full advisory and evidence Open source bulletin

All Veeam advisories

Follow CVE-2026-107671 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Veeam CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features