EUVD-2026-52753
GHSA-p88r-78hc-whhf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timing window requirement maps to AC:H; unauthenticated network exploitation (AV:N, PR:N); description confirms no integrity or availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
AnalysisAI
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied appliance API to unauthorized access during a short race window that opens immediately after a legitimate administrator session is initiated. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), allows a network attacker without any credentials to issue API calls that the system processes with Portal Administrator privileges. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the managed service provider management role targeted makes this a significant concern for MSP environments.
Technical ContextAI
Veeam Service Provider Console is a multi-tenant backup management platform used by managed service providers (MSPs) to orchestrate Veeam deployments across customer environments. The affected CPE (cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*) uses a wildcard version field, indicating all tracked versions are potentially affected. The root cause is CWE-306 (Missing Authentication for Critical Function), specifically a race condition in the session establishment pathway for the proxied appliance API: during the brief interval immediately following a Portal Administrator login event, the API endpoint fails to enforce authentication, momentarily treating unauthenticated callers as if they held Portal Administrator context. This is characteristic of a time-of-check to time-of-use (TOCTOU) pattern in authentication state management, where session context is propagated or checked inconsistently during initialization. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) designator formally captures this timing dependency as a real - but exploitable - constraint.
RemediationAI
Consult and apply the fix described in the Veeam vendor advisory at https://www.veeam.com/kb4893 - this is the primary and definitive remediation. A specific patched version number is not confirmed in the available data beyond the KB reference itself; verify the exact fixed version directly from the advisory before deployment. As compensating controls pending patching: restrict network-level access to the VSPC web console and proxied appliance API endpoints to trusted IP ranges or enforce VPN access, which reduces the attacker's ability to reach the vulnerable endpoint during the timing window; implement API gateway or WAF rules to rate-limit or alert on bursts of unauthenticated API calls to VSPC appliance proxy endpoints; and consider monitoring for API requests arriving within a configurable short interval of a new administrator session establishment event as a potential exploitation indicator. These controls reduce exposure surface but do not eliminate the underlying authentication flaw - patching remains the definitive remediation.
More in Service Provider Console
View allCredential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attac
Remote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers t
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plan
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memor
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today