CVE-2026-58073: Veeam Console Auth Bypass Vulnerability

CVE-2026-58073 Overview

CVE-2026-58073 is an authentication bypass vulnerability in Veeam Service Provider Console. The flaw allows an unauthenticated remote attacker to impersonate a managed agent and obtain that agent's credentials. Successful exploitation gives the attacker legitimate agent identity within the console, enabling downstream compromise of managed backup infrastructure and tenant environments.

The issue is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel. Veeam has published guidance in Veeam Knowledge Base Article KB4893.

Critical Impact
An unauthenticated network attacker can impersonate managed Veeam agents and harvest their credentials, leading to compromise of backup infrastructure and connected tenants.

Affected Products

Veeam Service Provider Console (VSPC)
Managed Veeam Agent deployments connected to a vulnerable VSPC instance
Downstream tenant environments relying on agent credentials issued by VSPC

Discovery Timeline

2026-08-04 - CVE-2026-58073 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-58073

Vulnerability Analysis

CVE-2026-58073 is an authentication bypass affecting the agent-to-console channel of Veeam Service Provider Console. The vulnerability lets an unauthenticated attacker impersonate a legitimate managed agent over the network. Once the impersonation succeeds, the console returns credentials associated with that agent to the attacker.

Those credentials are then usable to interact with the console as the impersonated agent. This turns a network-reachable console into a credential distribution point for adversaries. The attack requires no user interaction and no prior privileges on the target.

Root Cause

The underlying weakness is classified as CWE-288, authentication bypass using an alternate path or channel. The agent enrollment or identification flow accepts requests without validating the identity of the calling party through a secured authentication path. An attacker who reaches the exposed service endpoint can therefore claim an agent identity and receive credentials intended for that agent.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker with connectivity to a vulnerable Veeam Service Provider Console sends crafted requests that mimic a managed agent's registration or identification behavior. The console responds with credentials tied to that agent identity. The attacker then reuses those credentials to authenticate as the agent and interact with managed workloads.

No verified public proof-of-concept has been released. Technical mechanics are described in the Veeam Knowledge Base Article.

Detection Methods for CVE-2026-58073

Indicators of Compromise

Unexpected agent registration or re-enrollment events on the VSPC server that do not correlate with authorized deployment activity.
Repeated authentication or enrollment requests targeting the VSPC agent communication endpoint from unrecognized source addresses.
Duplicate agent identifiers active from two different source IP addresses within a short time window.
Use of agent credentials from geolocations or networks that do not match the historical baseline of the managed endpoint.

Detection Strategies

Alert on agent authentication events where the source IP differs from the last-known IP of the corresponding managed endpoint.
Correlate VSPC audit logs with endpoint telemetry to confirm that the endpoint associated with an agent identity actually initiated the session.
Monitor for anomalous outbound API calls executed under agent identities immediately after enrollment or credential retrieval.

Monitoring Recommendations

Forward VSPC application, authentication, and audit logs to a central SIEM or data lake for correlation with endpoint activity.
Establish a baseline of legitimate agent enrollment volume and cadence, and alert on statistical deviations.
Track network flows to the VSPC agent listener and flag traffic from hosts outside the sanctioned management network.

How to Mitigate CVE-2026-58073

Immediate Actions Required

Apply the fixed Veeam Service Provider Console build referenced in KB4893 as soon as it is available for your deployment.
Restrict network exposure of the VSPC agent communication port so that only known management networks can reach it.
Rotate credentials for any managed agents whose enrollment or authentication logs cannot be verified as legitimate.
Audit the list of registered agents in VSPC and remove entries that do not correspond to known assets.

Patch Information

Veeam has published remediation guidance in the Veeam Knowledge Base Article KB4893. Administrators should consult that advisory for the exact fixed version numbers and upgrade steps applicable to their deployment.

Workarounds

Place the VSPC server behind a firewall or VPN that limits agent connectivity to trusted network segments until patches are applied.
Enforce network-level access controls, such as IP allowlisting, on the console's agent-facing endpoints.
Increase logging verbosity on VSPC and forward events to a monitored log pipeline to shorten detection time while remediation is in progress.

bash

# Example: restrict inbound access to the VSPC agent port to a management subnet (Windows firewall)
New-NetFirewallRule -DisplayName "VSPC-Agent-Restrict" -Direction Inbound -Protocol TCP -LocalPort 9999 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "VSPC-Agent-Block-Other" -Direction Inbound -Protocol TCP -LocalPort 9999 -Action Block