Service Provider Console CVE-2026-58071

Exploitation requires the attacker to send a crafted API request to the Veeam Service Provider Console proxied appliance API endpoint during a short window that opens immediately after a legitimate Portal Administrator initiates an authenticated session - outside this window, the vulnerability is not exploitable. Network-level reachability of the VSPC API endpoint is required; no attacker authentication credentials are needed. The CVSS 4.0 AT:P designation confirms the timing condition is a genuine, non-trivial prerequisite: fully automated, opportunistic mass exploitation is constrained by the need to synchronize with an active administrator login event. There is no indication from the description or CPE that a non-default VSPC configuration is required - the vulnerable behavior appears present in standard deployments. Exploitation is limited by: the narrow timing window (window duration unspecified but described as 'short'), the need for network access to the API endpoint, and the requirement that a Portal Administrator session be actively initiating at the moment of attack.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) assigns high confidentiality impact with no integrity or availability consequence, and the AT:P flag explicitly acknowledges a specific attack requirement - the timing window - that meaningfully limits opportunistic exploitation. In CVSS 3.1 terms this timing dependency maps to AC:H, which is the most material risk moderator here. The vulnerability is not listed in the CISA KEV catalog and no public exploit code was referenced in any intelligence source, both supporting a lower immediate exploitation urgency. EPSS probability data was not provided, making probabilistic exploitation forecasting unavailable. The attack is fully unauthenticated and network-reachable (AV:N, PR:N), which is a genuine risk signal, but the requirement to synchronize a request with an active admin login event limits automated, opportunistic mass exploitation - a targeted actor with API familiarity and session observation capability is the realistic threat. The high confidentiality impact is credible given Portal Administrator API access would expose all managed tenant configurations and potentially downstream customer environments. No conflicting signals between sources are present, though the absence of a confirmed fixed version is a gap.

An attacker with network access to the VSPC API endpoint - whether via the internet if exposed, or from an internal network segment - monitors the system or uses timing-based probing to detect when a Portal Administrator initiates a login session. During the brief authentication gap that follows, the attacker issues a crafted API request to the proxied appliance API, which the system processes with Portal Administrator privileges, granting unauthorized access to managed appliance configurations and tenant backup data. No public exploit code exists at time of analysis, but the concept is achievable for a targeted actor with API documentation access and the ability to observe or predict administrator login timing.