Veeam VSPC CVE-2026-58067

No special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-accessible Veeam Service Provider Console instance with no prerequisite configuration, feature flag, or authenticated session. The primary limiting factor is network reachability: VSPC deployments protected behind VPNs, internal firewalls, or management-network-only ACLs are substantially harder to target. No specific VSPC feature or non-default configuration is described as required to trigger the memory exhaustion condition. The 'Information Disclosure' tag in the source data conflicts with the described DoS impact - defenders should verify with the vendor whether an additional exploitation condition exists that also produces an information disclosure effect.

The CVSS 4.0 score of 8.7 is credible and consistent with the described vulnerability: network-accessible, unauthenticated, no complexity barrier, high availability impact. This combination represents a genuine operational priority for any organization with VSPC exposed to untrusted networks. No KEV listing and no confirmed public exploit code lower the immediate urgency relative to actively exploited DoS issues, but the trivial exploitation prerequisites (AV:N/AC:L/PR:N/UI:N) mean this could be weaponized rapidly if a POC surfaces. A notable inconsistency exists in the source data: the vulnerability tag lists 'Information Disclosure' despite the description and CWE-789 pointing exclusively to a denial-of-service impact - this discrepancy must be verified against the vendor advisory at veeam.com/kb4893, as it may indicate additional impact dimensions not captured in the available data. EPSS data was not provided, so exploitation probability cannot be quantified beyond the structural signals from the CVSS vector.

An unauthenticated attacker with network access to the Veeam Service Provider Console sends a flood of crafted requests designed to trigger repeated, unbounded memory allocations within the VSPC process. As the host memory is progressively consumed without release, the VSPC service becomes unresponsive or the operating system invokes the OOM killer, rendering backup management operations unavailable across all managed MSP tenants. No public exploit code has been identified at time of analysis, but the low complexity and zero-authentication bar mean exploitation could be achieved with basic scripting.