The vulnerability in Veeam ONE allows an attacker who has acquired valid Administrator credentials to disable multi‑factor authentication globally before MFA verification is completed, effectively bypassing the security control and granting the attacker full system access. This weakness is a form of Authentication Bypass and could lead to unauthorized data exposure, configuration changes, or further compromise.

The flaw affects Veeam ONE. Because version details are not provided, all supported releases of Veeam ONE that implement global MFA controls are potentially impacted.

The issue carries a CVSS score of 8.5, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is no current evidence of exploitation in the wild. The likely attack vector requires the attacker to possess valid Administrator credentials; once in, the attacker simply toggles the global MFA setting to disable it, then proceeds with the usual authentication flow to gain full access. The combination of these conditions denotes a significant risk to confidentiality and integrity for systems that rely on MFA for privileged access.