Veeam Service Provider Console CVE-2026-58073

Exploitation requires network reachability to a Veeam Service Provider Console instance's agent-facing communication/API surface and the ability to invoke the managed-agent identification or enrollment flow. The core prerequisite is that the attacker can present itself as a specific existing managed agent - implying the attacker needs a valid/target agent identity to impersonate, which is the primary limiting factor and is consistent with the CVSS AC:H (high attack complexity, conditions outside attacker control) rating. No user interaction (UI:N) and no prior authentication (PR:N) are required. Exploitation is limited to environments where VSPC is deployed and network-exposed to the attacker; consoles reachable only from isolated management networks materially reduce exposure.

Signals are partly conflicting and should be weighed carefully. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) with all vulnerable- and subsequent-system impacts rated High produces a 9.5 'critical' - but AC:H explicitly signals the attack is NOT trivially repeatable and requires conditions outside the attacker's control, which tempers the raw score. The vector marks it network-reachable and unauthenticated (PR:N), the most dangerous combination, yet the described outcome is fundamentally credential disclosure rather than direct code execution, so the uniformly-High integrity/availability and subsequent-system metrics appear generous for the primary effect described. No EPSS score, no KEV listing, and no POC were provided, meaning there is no evidence of active or imminent mass exploitation; the H1 origin suggests a researcher-reported issue rather than in-the-wild abuse. Net: treat as a high-priority patch for MSP/provider-facing consoles because the management plane is high-value and the attack is pre-auth, but the AC:H barrier and absence of exploit evidence argue against emergency zero-day handling.

An attacker who can reach the VSPC server over the network initiates the agent identification/enrollment channel, presents the identity of an existing managed agent, and - bypassing authentication (CWE-288) - is returned that agent's credentials. The attacker then reuses those credentials to authenticate as the trusted agent and pivot toward the managed backup infrastructure. No POC is known, and the AC:H rating implies the attacker must satisfy non-trivial preconditions (e.g., knowing or guessing a valid agent identifier) to succeed.