EUVD-2026-52752
GHSA-3g66-chxf-wh5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated DoS with high availability impact and no confidentiality or integrity effect; scope unchanged as impact is confined to VSPC host.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.
AnalysisAI
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memory and cause a denial of service, with no authentication or user interaction required. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-prerequisite nature of exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact confined to the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low exploitation barrier makes any internet-exposed VSPC instance a realistic target.
Technical ContextAI
CWE-789 (Uncontrolled Memory Allocation) describes a vulnerability class where an application allocates memory in response to attacker-controlled input without enforcing an upper bound, enabling a resource-exhaustion denial of service. Veeam Service Provider Console (CPE: cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*) is a centralized management platform used by managed service providers to orchestrate Veeam backup infrastructure across multiple tenants and endpoints. The wildcard version field in the CPE string indicates the vulnerability spans all known VSPC versions without a narrower confirmed range. The CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:N) indicate the availability impact is bounded to the VSPC host itself rather than cascading to managed backup clients, though in practice VSPC unavailability disrupts backup management operations across the entire MSP tenant estate.
RemediationAI
The primary fix is to apply the vendor-released patch documented in the Veeam knowledge base at https://www.veeam.com/kb4893; however, an exact patched version number is not confirmed from the available data (patch available per vendor advisory - consult the KB article directly for the specific build). As an immediate compensating control, administrators should restrict network access to the VSPC management interface via firewall rules or network segmentation so that only trusted management subnets or VPN-connected hosts can reach VSPC endpoints - this directly addresses the AV:N/PR:N attack surface without service disruption. Additionally, deploying rate-limiting or connection throttling on inbound VSPC connections may reduce the effectiveness of memory exhaustion attempts but does not eliminate the root vulnerability. Organizations should avoid exposing VSPC directly to the internet regardless of patch status.
More in Service Provider Console
View allCredential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attac
Remote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers t
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plan
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied applianc
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today