CVE-2026-58067: Veeam Service Provider Console DoS Flaw

CVE-2026-58067 Overview

CVE-2026-58067 is a denial of service vulnerability in Veeam Service Provider Console. An unauthenticated remote attacker can exhaust host memory by sending crafted network requests, causing the service to become unresponsive. The flaw is categorized under [CWE-789] Memory Allocation with Excessive Size Value, indicating that the application allocates memory based on attacker-influenced input without adequate bounds enforcement.

The vulnerability carries a CVSS 4.0 base score of 8.7 and can be triggered across the network without user interaction or prior credentials. Veeam published guidance in Veeam Knowledge Base Article KB4893.

Critical Impact
An unauthenticated attacker can remotely exhaust host memory on Veeam Service Provider Console, disrupting availability for managed service provider operations and downstream tenants.

Affected Products

Veeam Service Provider Console (VSPC)
Refer to Veeam KB4893 for the definitive list of affected versions
Managed service provider deployments running exposed VSPC instances

Discovery Timeline

2026-08-04 - CVE-2026-58067 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-58067

Vulnerability Analysis

CVE-2026-58067 is a memory exhaustion denial of service issue in Veeam Service Provider Console. The vulnerability allows an unauthenticated network attacker to force the application to allocate excessive memory. Sustained or repeated exploitation drives the host into memory pressure, causing service degradation, thrashing, or process termination.

Because Veeam Service Provider Console is typically deployed by managed service providers to orchestrate backup infrastructure across multiple tenants, disruption of the console impacts monitoring, reporting, and management workflows across the environments it services. The console does not need to hold sensitive data for the attack to have operational consequence; loss of availability alone impedes provider operations.

Root Cause

The underlying weakness maps to [CWE-789] Memory Allocation with Excessive Size Value. The application accepts a size value or repeated allocation requests from a network client without enforcing an upper bound proportional to available resources. Attacker-controlled input drives allocations that scale beyond safe limits, exhausting the process heap and, ultimately, host memory.

Attack Vector

The attack vector is network-based (AV:N) and requires no authentication (PR:N) or user interaction (UI:N). An attacker with network reachability to the Veeam Service Provider Console listener sends crafted requests that cause repeated or oversized memory allocations. No specific timing conditions or prerequisites are documented beyond network access.

Exploitation code is not publicly available at the time of publication, and this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical specifics on the vulnerable component and request pattern are described in the Veeam Knowledge Base Article.

Detection Methods for CVE-2026-58067

Indicators of Compromise

Sudden and sustained memory growth in the Veeam Service Provider Console service process
Unresponsive VSPC web console or management API despite the host being reachable
Repeated inbound connections from a single source to VSPC network ports preceding memory spikes
Application or Windows event log entries indicating out-of-memory conditions or service crashes

Detection Strategies

Monitor VSPC process memory usage against a rolling baseline and alert on rapid growth outside normal operating windows
Inspect network telemetry for high-rate or oversized requests directed at VSPC listening ports from untrusted networks
Correlate VSPC service restarts and out-of-memory events with preceding network activity to identify probing patterns

Monitoring Recommendations

Enable performance counters for the VSPC service process and forward metrics to a centralized monitoring system
Capture Windows Event Log, IIS logs, and VSPC application logs for review after any service disruption
Alert on repeated connections from external addresses to VSPC endpoints that should only be reached by internal management networks

How to Mitigate CVE-2026-58067

Immediate Actions Required

Apply the fixed version referenced in Veeam KB4893 as soon as maintenance windows allow
Restrict network reachability to the Veeam Service Provider Console to trusted management networks and VPN segments
Inventory all VSPC deployments, including tenant-facing instances, and verify their patch status
Review recent VSPC service crashes and memory alerts to identify possible prior exploitation attempts

Patch Information

Veeam has published remediation guidance in Veeam Knowledge Base Article KB4893. Administrators should consult the advisory for the fixed build numbers and upgrade procedures specific to their Veeam Service Provider Console deployment.

Workarounds

Place VSPC behind a reverse proxy or firewall that enforces rate limiting and request size limits on inbound traffic
Limit inbound access to VSPC ports to a defined allowlist of management workstations and tenant collector hosts
Increase monitoring sensitivity on VSPC hosts so that memory exhaustion events trigger rapid operator response until patching is complete

bash

# Example: restrict inbound access to VSPC management port on Windows Server
# Replace <TRUSTED_SUBNET> with the CIDR range of your management network
New-NetFirewallRule -DisplayName "VSPC-Restrict-Mgmt" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9999 `
  -RemoteAddress <TRUSTED_SUBNET> `
  -Action Allow

New-NetFirewallRule -DisplayName "VSPC-Block-Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9999 `
  -Action Block