A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107671 · Microsoft / collected KEV context

cve-program · CVE-2026-107671

• https://www.veeam.com/kb4951

• A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. · Newly collected advisory · 27 Oct 2026