This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Veeam Service Provider Console and ONE fix 10 vulnerabilities

Veeam fixes 10 vulnerabilities in 2 products, 3 of which are critical [1][2]. The fix for Veeam Service Provider Console is in version 9.3.0.35057 and for Veeam ONE in version 13.1.0.7034 [1][2]. The most severe vulnerabilities are listed below.

Veeam Service Provider Console - agent impersonation (CVE-2026-58073)
CVSS 9.5 (Critical)

An unauthenticated remote attacker can bypass the standard authentication method in Veeam Service Provider Console to impersonate a managed agent and thereby obtain its credentials [1].

The vulnerability is present in product:

  • Veeam Service Provider Console; >=9.0,<=9.2.1.33875;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

The vulnerability was publicly disclosed 4. 8. 2026.

Veeam Service Provider Console - RCE (CVE-2026-58072)
CVSS 9.0 (Critical)

An authenticated remote attacker can write arbitrary files on the management server in Veeam Service Provider Console, which may lead to code execution [1].

The vulnerability is present in product:

  • Veeam Service Provider Console; >=9.0,<=9.2.1.33875;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

  • CVE-2026-58072 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 8. 2026.

Veeam ONE - RCE (CVE-2026-64633)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute code in Veeam ONE on a machine with the agent installed [2].

The vulnerability is present in product:

  • Veeam ONE; >=13.0, <=13.0.2.6723;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

The vulnerability was publicly disclosed 4. 8. 2026.

By CESNET, z.s.p.o. Martin Krajči on 5. 8. 2026.

CESNET, z.s.p.o. Logo