Veeam Service Provider Console vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20266

Newest CVEs

• CVE-2026-58072

  A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.

  Veeam · Service Provider Console

  Critical9.0
• CVE-2026-58073

  A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.

  Veeam · Service Provider Console

  Critical9.5
• CVE-2026-58071

  A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a…

  Veeam · Service Provider Console

  High8.2
• CVE-2026-58067

  A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.

  Veeam · Service Provider Console

  High8.7
• CVE-2026-64635

  Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control…

  Veeam · Service Provider Console

  Medium5.3
• CVE-2026-32998

  This vulnerability in Veeam Service Provider Console allows for remote code execution.

  Veeam · Service Provider Console

  Critical9.4
• CVE-2024-42448

  From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution…

  Veeam · Service Provider Console

  Critical9.9
• CVE-2024-45206

  A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and…

  Veeam · Service Provider Console

  Medium6.5
• CVE-2024-42449

  From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the…

  Veeam · Service Provider Console

  High7.1
• CVE-2024-29212

  Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its…

  Veeam · Service Provider Console

  Critical9.9