Which versions of Veeam Service Provider Console are affected by CVE-2026-58072?

Veeam Service Provider Console (VSPC) contains a critical arbitrary file write vulnerability (CVE-2026-58072, CVSS 9.0) affecting all in-scope versions, enabling authenticated low-privilege remote…. A patch is available.

How to fix or mitigate CVE-2026-58072?

Within 24 hours: conduct a complete inventory of VSPC deployments and versions, review server access logs for suspicious file write or path traversal activity, and implement immediate network-level access controls restricting VSPC console connectivity to essential administrative IP ranges via firewall. Within 7 days: deploy file integrity monitoring and anomaly detection on all VSPC server directories to alert on unauthorized file modifications, audit and reduce privileges for all low-privilege accounts with VSPC access to minimum necessary permissions, and enable comprehensive audit logging for file operations and path traversal patterns. Within 30 days: monitor Veeam's security advisory channels for patch availability, prepare and test an emergency patch deployment procedure with communication workflows, and deploy immediately upon vendor release.

Veeam Service Provider Console CVE-2026-58072

Q: What is the CVSS score of CVE-2026-58072?

CVE-2026-58072 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52761 CRITICAL

Path Traversal (CWE-22)

2026-08-04 hackerone

GHSA-9rh3-3258-4p43

Path Traversal Service Provider Console Veeam

9.0

CVSS 4.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable authenticated file write (PR:L), AC:H reflects the AT:P precondition, S:C because file-write-to-RCE impacts the broader managed environment, full CIA loss on the management server.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 17:16 EUVD

Analysis Generated

Aug 04, 2026 - 17:08 vuln.today

CVE Published

Aug 04, 2026 - 15:56 cve.org

CRITICAL 9.0

DescriptionCVE.org

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.

AnalysisAI

Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plant or overwrite files on the management server via path traversal (CWE-22), which can be escalated to remote code execution on that server. All versions matched by the wildcard CPE are provisionally in scope pending vendor confirmation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.0 (Critical), driven by high confidentiality, integrity and availability impact plus subsequent-system impact.

Technical ContextAI

Veeam Service Provider Console is a centralized management and monitoring platform used primarily by managed service providers and enterprises to administer distributed Veeam backup infrastructure across many tenants. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the management server accepts an attacker-influenced path without properly canonicalizing or constraining it, allowing writes outside the intended directory. Because the write lands on the management server's filesystem, an attacker can target locations that are later executed or loaded by the service (for example dropping a script, web-executable, plugin, or configuration/binary in a path the server processes), turning an arbitrary file write into code execution. The affected component per CPE is cpe:2.3:a:veeam:service_provider_console with an unbounded version field, so the exact fixed and vulnerable builds must be read from the Veeam advisory.

RemediationAI

Apply the Veeam-provided fix as documented in the vendor advisory at https://www.veeam.com/kb4893; consult that article for the exact patched build number, since a precise fixed version was not included in the provided data (Patch available per vendor advisory). Until patched, reduce exposure by restricting network access to the VSPC management server and its management/API ports so only trusted administrative networks can reach it, and tighten account provisioning since exploitation requires an authenticated low-privileged account - audit and remove unnecessary or weakly-authenticated tenant/operator accounts and enforce strong credentials and MFA. Place the console behind a VPN or IP allowlist rather than direct internet exposure; the trade-off is reduced remote accessibility for legitimate operators. Monitor the management server filesystem and logs for unexpected file creation in service-executable paths as a detective control. Do not rely on workarounds long term - upgrading to the fixed build is the only complete remediation.