EUVD-2026-52758
GHSA-j78w-mw5c-ppvh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth network impersonation is high-complexity (AC:H) needing a valid agent identity; primary impact is credential disclosure (C:H), with stolen creds affecting managed agents (S:C, I:L), no availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
AnalysisAI
Credential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attacker to masquerade as a legitimately managed backup agent and harvest that agent's credentials. Because VSPC is the multi-tenant management plane MSPs use to orchestrate backups across customer estates, captured agent credentials give an attacker a foothold to pivot into managed endpoints. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (9.5) and CWE-288 identifies an authentication-bypass root cause.
Technical ContextAI
Veeam Service Provider Console is Veeam's centralized, web/API-driven management platform that lets service providers remotely deploy, monitor, and control Veeam backup agents across many tenant environments. Affected component per CPE is cpe:2.3:a:veeam:service_provider_console (all versions listed with a wildcard, so no fixed lower bound is enumerated in NVD data). The weakness is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the agent enrollment/identification channel apparently trusts an attacker-supplied identity claim without properly authenticating it, letting the attacker present itself as an existing managed agent. Once impersonation succeeds, the server discloses the impersonated agent's credentials - an information-disclosure outcome, consistent with the 'Information Disclosure' tag.
RemediationAI
Patch available per vendor advisory: consult Veeam KB4893 (https://www.veeam.com/kb4893) for the exact patched build and upgrade VSPC to that release; an exact fix version was not provided in the input and should not be assumed. Because this is a pre-authentication issue on the management plane, until patching is complete restrict network reachability of the VSPC server and its agent-communication/API ports to trusted management networks or a VPN, and place the console behind a firewall or reverse proxy that limits which sources can initiate agent enrollment - the trade-off is that legitimate remote agents or provider staff on untrusted networks may lose connectivity and require allow-listing. Additionally, after patching, rotate credentials for managed agents that could have been exposed, since a successful attack discloses agent credentials.
More in Service Provider Console
View allRemote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers t
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plan
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memor
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied applianc
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today