【Vulnerability Alert】Veeam Service Provider Console Contains Two Critical Cybersecurity Vulnerabilities
Source: Ministry of education information & communication security contingency platform
"" "" ""
| Publication Number | TACERT-ANA-2026080605082121 | Publication Time | 2026-08-06 17:31:22 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-08-06 17:31:22 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】Veeam Service Provider Console Contains Two Critical Cybersecurity Vulnerabilities |
|||
| [Content]
Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000006 Veeam Service Provider Console (VSPC), a remote management console developed by backup and data protection software vendor Veeam, is a remote monitoring and management tool used across on-premises and cloud application environments. Recently, the official vendor released patches for two high-risk cybersecurity vulnerabilities (CVE-2026-58073, CVSS 4.x: 9.5, and CVE-2026-58072, CVSS 4.x: 9.0). CVE-2026-58073 allows an unauthenticated attacker to impersonate a managed agent and obtain its credentials; CVE-2026-58072 allows arbitrary file writes to the management server, which may lead to remote code execution. Information Sharing Level: WHITE (the intelligence content is information that may be publicly disclosed) |
|||
| [Affected Platform]
Veeam Service Provider Console version 9, Veeam Service Provider Console 9.2.1.33875 |
|||
|
[Recommended Actions] Please update Veeam Service Provider Console to version 9.3.0.35057 or later |
|||
|
[Reference] 1. https://www.veeam.com/kb4893 |
|||
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw