Veeam Service Provider Console vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Veeam Service Provider Console: 6 record(s), with affected versions and fixes.
CVE-2026-58073
Critical · 9.5
CWE-288 Aug 4, 2026
Authentication Bypass Using an Alternate Path or Channel in Veeam Service Provider Console
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
CVE-2026-58072
Critical · 9.0
CWE-22 Aug 4, 2026
Path Traversal in Veeam Service Provider Console
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
CVE-2026-58071
High · 8.2
CWE-306 Aug 4, 2026
Missing Authentication for Critical Function in Veeam Service Provider Console
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
CVE-2026-58067
High · 8.7
CWE-789 Aug 4, 2026
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker…
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.
CVE-2026-64635
Medium · 5.3
CWE-640 Jul 30, 2026
Weak Password Recovery Mechanism in Veeam Service Provider Console
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.
CVE-2026-32998
Critical · 9.4
CWE-233 May 28, 2026
This vulnerability in Veeam Service Provider Console allows for remote code execution.
This vulnerability in Veeam Service Provider Console allows for remote code execution.