CVE-2026-58071 Overview
CVE-2026-58071 is a missing authentication vulnerability [CWE-306] in Veeam Service Provider Console. The flaw allows an unauthenticated remote attacker to access the proxied appliance Application Programming Interface (API) with Portal Administrator privileges. Exploitation is possible during a short time window that begins when an administrator session is established. The vulnerability is network-reachable and requires no user interaction, though a specific timing condition must be met by the attacker. Successful exploitation results in disclosure of sensitive data reachable through the proxied appliance API.
Critical Impact
Unauthenticated attackers can access the proxied appliance API as Portal Administrator during a race window following administrator authentication, exposing sensitive tenant and appliance data.
Affected Products
- Veeam Service Provider Console (VSPC)
- Proxied appliance API endpoints exposed by VSPC
- Refer to the Veeam Knowledge Base Article for the exact affected build list
Discovery Timeline
- 2026-08-04 - CVE-2026-58071 published to the National Vulnerability Database (NVD)
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-58071
Vulnerability Analysis
CVE-2026-58071 is classified as Missing Authentication for a Critical Function [CWE-306]. The Veeam Service Provider Console proxies API requests to a backend appliance API on behalf of authenticated administrators. When a Portal Administrator session starts, the proxy transitions into an authenticated state. During this short interval, the proxy accepts requests without validating the caller's own session against the administrator context.
An attacker who reaches the console over the network can send crafted requests to the proxied API path within that window. The proxy forwards the calls under Portal Administrator authority. The attacker receives responses containing data that should only be reachable by an authenticated administrator, resulting in high confidentiality impact with no direct integrity or availability effect.
Root Cause
The root cause is an authentication check that binds to the administrator session lifecycle rather than to the individual request. The proxy layer assumes any inbound call during the active administrator window is authorized. This design omits a per-request authentication and authorization decision on the proxied appliance API [CWE-306].
Attack Vector
Exploitation is performed remotely over the network against the VSPC web interface. The attacker does not need credentials, prior access, or user interaction. The attacker must issue requests during the short window that follows administrator login, which introduces a timing dependency. Public exploit code is not currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is available at this time. See the Veeam Knowledge Base Article for vendor technical details.
Detection Methods for CVE-2026-58071
Indicators of Compromise
- Unexpected requests to the proxied appliance API path from source addresses that never completed Portal Administrator authentication
- Bursts of API calls timed within seconds of an administrator login event in VSPC access logs
- Portal Administrator API responses correlated with sessions that have no matching authentication record
Detection Strategies
- Correlate VSPC authentication events with proxied API access events and flag API calls that lack a matching authenticated session identifier
- Baseline the volume and source distribution of proxied appliance API calls, then alert on deviations following administrator logins
- Inspect web server and reverse proxy logs for repeated probing of appliance API endpoints from a single external source
Monitoring Recommendations
- Forward VSPC application, authentication, and web access logs to a centralized Security Information and Event Management (SIEM) platform for correlation
- Enable verbose auditing on the proxied appliance API so every request records the caller identity, session identifier, and source address
- Monitor for administrator session initiation events and apply short-window detection rules against subsequent proxied API traffic
How to Mitigate CVE-2026-58071
Immediate Actions Required
- Apply the fixed Veeam Service Provider Console build referenced in the Veeam Knowledge Base Article as soon as it is available in your change window
- Restrict network reachability of the VSPC portal to trusted management networks and Virtual Private Network (VPN) users
- Rotate Portal Administrator credentials and review recent proxied appliance API activity for signs of unauthorized access
Patch Information
Veeam has published guidance and fixed build information in the Veeam Knowledge Base Article KB4893. Administrators should upgrade to the vendor-designated fixed version of Veeam Service Provider Console. Confirm the upgrade covers both the console and any co-located appliance components exposing the proxied API.
Workarounds
- Place the VSPC portal behind a reverse proxy or Web Application Firewall (WAF) that enforces per-request authentication before requests reach the proxied appliance API
- Limit administrator logins to jump hosts on isolated management segments to reduce the exposure of the timing window
- Disable or firewall the proxied appliance API path from untrusted networks until the vendor patch is installed
# Example: restrict access to the VSPC portal to a management CIDR using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
