Veeam Service Provider Console CVE-2026-58072

Exploitation requires an authenticated account on the Veeam Service Provider Console (CVSS PR:L - a low-privileged operator or tenant-level login is sufficient, not full admin) and network reachability to the management server (AV:N). The CVSS 4.0 attack requirement flag (AT:P) signals that a specific condition or state beyond a normal request must be met for the path-traversal write to succeed; the provided description does not name the exact feature or endpoint, so the precise triggering configuration should be verified against the Veeam KB. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce real-world risk: the attacker must already possess valid VSPC credentials, and the AT:P precondition means it is not a universal unauthenticated exploit against any default install.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N with VC/VI/VA:H and SC/SI/SA:H, score 9.0 Critical) indicates a network-reachable, low-complexity attack that requires low privileges (PR:L, i.e. an authenticated account) and carries an attack requirement (AT:P), meaning a specific precondition or configuration state must exist rather than firing against any request. This is a genuine high priority for anyone running VSPC exposed to tenants or the internet, because authenticated file-write-to-RCE on a multi-tenant management server has severe blast radius (the subsequent-system High metrics reflect impact beyond the immediately vulnerable component). However, exploitation is gated by needing valid credentials and the AT:P precondition, which tempers the raw score: this is not unauthenticated drive-by RCE. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; there is no KEV listing and no POC signal, so current evidence points to a serious-but-not-yet-actively-exploited flaw. The report originates from HackerOne, consistent with coordinated disclosure rather than in-the-wild discovery.

A low-privileged tenant or operator account holder authenticates to an internet-reachable VSPC instance and sends a crafted request whose path parameter contains directory-traversal sequences, causing the management server to write attacker-controlled content outside the intended directory. The attacker drops an executable or server-processed file into a location the console later runs, obtaining code execution as the service account on the management server. No public POC has been identified, and the attack requires valid credentials plus the specific precondition implied by AT:P.