CVE-2026-58072: Veeam Service Provider Console RCE Flaw

CVE-2026-58072 Overview

CVE-2026-58072 is a critical vulnerability in Veeam Service Provider Console (VSPC) that allows authenticated attackers to write arbitrary files to the management server. Successful exploitation can lead to remote code execution on the underlying host. The flaw is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal), enabling attackers to escape intended file storage boundaries. Veeam has published a knowledge base advisory acknowledging the issue and providing guidance to affected operators.

Critical Impact
An authenticated network attacker with low privileges can write arbitrary files to the VSPC management server and achieve remote code execution, compromising the platform used by service providers to manage tenant backup infrastructure.

Affected Products

Veeam Service Provider Console (management server component)
Refer to the Veeam Knowledge Base Article for specific affected build numbers
Deployments exposing the VSPC management interface to authenticated users

Discovery Timeline

2026-08-04 - CVE-2026-58072 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-58072

Vulnerability Analysis

The vulnerability resides in file-handling logic within the Veeam Service Provider Console management server. An authenticated user can supply crafted input that is not properly sanitized before being used in file system operations. This allows the attacker to direct write operations outside intended directories.

Because the VSPC management server runs with elevated service privileges, arbitrary file write primitives translate directly into code execution. Attackers can drop executables, scheduled task definitions, or replace trusted binaries and configuration files loaded by the service. The attack requires network access to the management interface and low-privileged authentication.

VSPC is deployed by managed service providers to orchestrate Veeam Backup & Replication across tenants. Compromise of a VSPC instance therefore extends attacker reach to downstream customer environments managed by the console.

Root Cause

The root cause is a path traversal weakness [CWE-22]. Input paths accepted by the management server are not canonicalized or constrained to a safe base directory. Sequences such as ..\ traverse out of the intended upload or working directory and target system-writable locations.

Attack Vector

Exploitation proceeds over the network against the VSPC management server. The attacker authenticates with valid low-privilege credentials, then submits a request containing a crafted file name or path parameter. The server writes the attacker-supplied content to a location that grants execution, such as a service auto-load path or a scheduled task directory. The dropped payload then executes in the security context of the VSPC service.

No verified proof-of-concept code is publicly available. Refer to the Veeam Knowledge Base Article for vendor-supplied technical detail.

Detection Methods for CVE-2026-58072

Indicators of Compromise

Unexpected file creation in VSPC installation directories, Windows\System32, or scheduled task folders originating from the VSPC service account
New or modified DLLs, executables, or scripts under paths loaded by Veeam services
Anomalous authenticated API sessions to the VSPC management server followed by outbound child processes such as cmd.exe or powershell.exe spawned by VSPC service binaries
Web or API request logs containing path traversal sequences like ..%2f or ..\ targeting file upload endpoints

Detection Strategies

Enable file integrity monitoring on the VSPC management server for binaries, configuration files, and service directories
Alert on process creation events where the VSPC service parent process spawns interpreters or living-off-the-land binaries
Inspect VSPC application and IIS logs for suspicious request paths containing directory traversal patterns

Monitoring Recommendations

Forward VSPC host telemetry, including process, file, and authentication events, into a centralized analytics platform for correlation
Baseline normal write activity of the VSPC service account and alert on deviations to system or startup paths
Track authentication events for low-privilege VSPC accounts and flag unusual API access patterns

How to Mitigate CVE-2026-58072

Immediate Actions Required

Apply the patched VSPC build documented in the Veeam Knowledge Base Article without delay
Restrict network access to the VSPC management interface to trusted administrative networks and VPN endpoints
Rotate credentials for all VSPC user accounts and audit account privileges, removing unused low-privilege accounts
Review the management server for signs of prior exploitation, including unexpected files and scheduled tasks

Patch Information

Veeam has published remediation guidance and fixed builds in the Veeam Knowledge Base Article. Operators should consult the advisory for the specific patched version applicable to their deployment and follow the vendor's upgrade procedure.

Workarounds

Where immediate patching is not feasible, isolate the VSPC management server behind network segmentation and jump hosts
Disable or restrict authenticated endpoints exposed to non-administrative users until the patch is applied
Enforce multi-factor authentication on all VSPC accounts to raise the bar for credential-based access

bash

# Configuration example: restrict inbound access to the VSPC management port
# Replace <admin-subnet> with your administrative network range
New-NetFirewallRule -DisplayName "VSPC-Admin-Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9999 `
  -RemoteAddress <admin-subnet> `
  -Action Allow

New-NetFirewallRule -DisplayName "VSPC-Block-Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9999 `
  -Action Block