CVE-2026-58074: High-Privileged RCE Vulnerability

CVE-2026-58074 Overview

CVE-2026-58074 is an authenticated remote code execution vulnerability that allows a high-privileged user to execute arbitrary code on the server. The flaw is tracked under CWE-94: Improper Control of Generation of Code, indicating a code injection weakness. Veeam published details in Veeam Knowledge Base Article KB4892. Successful exploitation results in complete compromise of confidentiality, integrity, and availability on the affected host.

Critical Impact
An authenticated attacker with high privileges can execute arbitrary code on the target server, leading to full system compromise.

Affected Products

Veeam product line as described in Veeam KB4892
Specific affected versions are not enumerated in the NVD record at time of publication
Refer to the vendor advisory for the authoritative list of impacted builds

Discovery Timeline

2026-08-04 - CVE-2026-58074 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-58074

Vulnerability Analysis

The vulnerability stems from improper control of code generation within the affected Veeam component, classified as [CWE-94]. An authenticated attacker holding high privileges on the application can supply input that the server processes as executable code rather than data. This results in arbitrary code execution in the context of the server process.

The attack is delivered over the network without user interaction. Because the vulnerability requires high privileges, exploitation depends on the attacker already holding a privileged account or chaining this flaw with a prior credential compromise or privilege escalation. Once triggered, the attacker gains full control over confidentiality, integrity, and availability of the host.

The EPSS probability at publication is approximately 0.35%, reflecting no observed exploitation activity in the wild at this time.

Root Cause

The root cause is unsafe handling of attacker-controlled input that flows into a code interpretation or evaluation path. The application does not sufficiently constrain the input before it is compiled, evaluated, or otherwise executed by the server runtime. See Veeam KB4892 for vendor technical details.

Attack Vector

An attacker authenticates to the Veeam management interface using an existing high-privileged account. The attacker then submits crafted input to a server-side function that generates or interprets code from that input. The server executes the injected payload with the privileges of the Veeam service account, yielding arbitrary command execution on the host.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the vendor advisory for technical details rather than synthesized exploit code.

Detection Methods for CVE-2026-58074

Indicators of Compromise

Unexpected child processes spawned by the Veeam service account, particularly cmd.exe, powershell.exe, or scripting hosts
Anomalous outbound network connections initiated by Veeam server processes
New scheduled tasks, services, or persistence artifacts created shortly after Veeam administrative logins
Audit log entries showing high-privileged administrative actions from unusual source IPs or off-hours

Detection Strategies

Monitor Veeam application and Windows security event logs for administrative authentication events followed by process creation anomalies
Baseline the normal process tree of Veeam services and alert on deviations such as shell or interpreter spawns
Inspect Veeam management API traffic for payloads containing script or code fragments in fields that normally accept configuration values

Monitoring Recommendations

Enable command-line logging (Windows Event ID 4688 with process arguments) on servers hosting Veeam components
Forward Veeam and host telemetry to a centralized platform for behavioral correlation across privileged account activity
Alert on any administrative account use that originates outside approved management networks or jump hosts

How to Mitigate CVE-2026-58074

Immediate Actions Required

Apply the fixed build referenced in Veeam KB4892 as soon as it is available in your change window
Audit accounts with high privileges on Veeam servers and remove any that are unnecessary or dormant
Rotate credentials for privileged Veeam accounts and enforce multi-factor authentication where supported
Review recent administrative activity logs for signs of misuse pending patch deployment

Patch Information

Veeam has published remediation guidance in Veeam Knowledge Base Article KB4892. Administrators should consult that advisory for the exact fixed versions and upgrade procedure applicable to their deployment.

Workarounds

Restrict network access to the Veeam management interface to a dedicated administrative network segment or jump host
Enforce least privilege by reducing the number of accounts granted high-privileged roles within Veeam
Require multi-factor authentication for all privileged access to Veeam consoles and APIs
Increase log retention and monitoring on Veeam hosts until patching is complete

bash

# Example: restrict inbound access to the Veeam management port to an admin subnet (Windows Firewall)
New-NetFirewallRule -DisplayName "Veeam-Mgmt-Restrict" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9392 `
  -RemoteAddress 10.10.50.0/24 `
  -Action Allow