Veeam Service Provider Console CVE-2026-32998

Exploitation requires network reachability to the Veeam Service Provider Console web/API interface and valid authentication at low privilege level (CVSS PR:L) - any legitimate console account, including limited tenant-operator roles typical in MSP deployments, appears sufficient. No user interaction (UI:N) and no additional attack requirements (AT:N) are needed once authenticated, and attack complexity is low (AC:L). Exploitation is limited to Service Provider Console versions 9 through 9.2; deployments fully isolated behind VPN/management-network ACLs and those with strictly controlled console account provisioning materially reduce the realistically reachable attacker population.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) indicates network-reachable, low-complexity exploitation by an authenticated user with no user interaction, producing high impact on both the vulnerable system and adjacent (subsequent) systems - a strong signal given VSPC's role bridging providers and tenants. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is not in CISA KEV and no POC has been identified, so this is not currently confirmed as actively exploited; however, Veeam products have historically attracted ransomware operator interest, and the PR:L threshold is easily met in MSP environments where many tenant operators hold console accounts. Prioritize as a high-severity patching target despite the absence of in-the-wild signals.

An attacker who has obtained or compromised any low-privileged Veeam Service Provider Console account - for example, a tenant operator credential phished from an MSP customer - authenticates to the console over the network and submits a crafted request containing malicious parameter values to a vulnerable endpoint, triggering arbitrary code execution on the VSPC host. Because the CVSS scope is changed (SC:H/SI:H/SA:H), the attacker can pivot from the management plane into managed tenant environments and the backup infrastructure those tenants rely on. No public exploit identified at time of analysis.