CVE-2026-58073 affects Veeam Service Provider Console, a platform used by managed service providers and organizations to monitor and administer backup agents across multiple environments. The vulnerability matters because an attacker may impersonate a legitimate managed agent without first proving their identity, potentially exposing credentials used within backup operations.
If your organization operates Veeam Service Provider Console, relies on a managed service provider for Veeam administration, or connects business systems to a vulnerable console, you should treat this issue as a priority. A compromise could affect not only one server, but also multiple customers, tenants, or protected workloads connected to the console.
This post explains what CVE-2026-58073 means for your business, how to assess exposure, what warning signs to review, and which response steps can reduce risk. Technical implementation details appear in the appendix for security and IT professionals.
CVE-2026-58073 was published in the National Vulnerability Database on August 4, 2026. The affected product is Veeam Service Provider Console, specifically version 9 builds earlier than 9.3. The vulnerability was submitted through HackerOne and is classified as CWE-288, which describes authentication bypass through an alternate path or channel.
In plain language, the console can accept an attacker as though the attacker were a legitimate managed agent. The attacker may then obtain credentials associated with that agent. Veeam guidance is published in Knowledge Base Article KB4893.
Public vulnerability databases report a CVSS version 4.0 score of 9.5, rated Critical. The National Vulnerability Database has not yet supplied its own CVSS assessment, so organizations should document the scoring source used in their risk register.
The key timeline is straightforward. Veeam’s vulnerability guidance was made available during August 2026, the CVE was published on August 4, and the NVD record was last modified on September 3, 2026.
CVE-2026-58073 creates a business risk because backup management systems are highly trusted. If an attacker obtains credentials belonging to a managed agent, the attacker may gain a foothold in the systems responsible for protecting, monitoring, or administering business data.
For you, the consequences could include unauthorized access to backup infrastructure, manipulation of backup operations, exposure of credentials, or interference with recovery during a ransomware incident. The risk is especially significant when one Veeam Service Provider Console manages environments for several customers. A single compromised control point may affect multiple organizations rather than one isolated system.
Operational disruption is another concern. If attackers use stolen agent credentials to alter registrations, interfere with jobs, or access connected resources, your recovery objectives may become unreliable. You could discover that backups exist but cannot be trusted, restored, or accessed when needed.
The incident may also create privacy, contractual, and regulatory obligations. Depending on the data and customers involved, credential exposure could trigger breach investigation, notification, cyber-insurance reporting, or requirements under laws and sector rules in the United States or Canada.
Reputation can suffer even when no production database is stolen. Customers expect backup providers and internal technology teams to protect recovery systems with the same care applied to primary systems. Prompt patching, credential rotation, and documented verification help demonstrate responsible risk management.
Regional Bank: A regional bank uses a service provider to manage Veeam agents across branch servers. An attacker reaches the exposed console, impersonates an agent, and obtains credentials that provide a path into the bank’s backup management environment. The bank may face interrupted recovery operations, customer notification questions, and scrutiny from regulators or auditors.
Healthcare Provider: A midsize healthcare provider relies on a managed backup platform for systems containing patient and billing information. If an attacker obtains agent credentials, the organization may need to investigate whether protected health information was accessed, even if there is no immediate evidence of data theft. Recovery delays could also affect clinical and administrative operations.
Manufacturing Group: A manufacturer with plants in several states or provinces uses one centrally managed console for file servers and production-support systems. A compromise at the console could allow an attacker to target multiple sites, increasing the cost of containment and making it harder to determine which systems remain trustworthy.
Managed Service Provider: A managed service provider operates one Veeam Service Provider Console for many small-business customers. The provider faces concentrated risk because one vulnerable platform may expose credentials or management relationships associated with multiple tenants. Customer communications, forensic analysis, and coordinated remediation may be required across the entire client base.
Do not wait for a recovery crisis to reveal weaknesses in your backup management environment. Contact IntegSec for a focused penetration test, exposure review, and practical cybersecurity risk reduction plan. Our team can help validate patching, examine authentication paths, test network controls, and identify weaknesses that attackers could exploit next.
CVE-2026-58073 is an authentication bypass in the managed-agent communication path of Veeam Service Provider Console. The affected component is the console’s agent-facing service and its process for identifying or enrolling managed agents. The root cause is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel.
The attack is network-based and requires no prior privileges or user interaction. An unauthenticated attacker can send crafted requests that imitate a legitimate managed agent. When the console accepts the claimed agent identity, it may return credentials associated with that agent.
Public sources identify VSPC version 9.2.1.33875 and earlier version 9 releases as affected, with version 9.3 identified as the fixed branch. Some research describes the affected service as listening on TCP port 9999, but administrators should confirm the actual listener and deployment configuration before making firewall changes.
The public NVD record does not currently provide a CVSS vector or NVD-assigned score. It does list the HackerOne source, CWE-288, and affected versions earlier than 9.3. Third-party and vendor-related reporting identifies a CVSS 4.0 score of 9.5, Critical.
Version enumeration commands:
Linux-based inventory systems should query the organization’s software-management database, package records, or authenticated remote inventory rather than relying on a single host command.
Scanner signatures: Validate that vulnerability scanners identify Veeam Service Provider Console versions earlier than 9.3 and map the result to CVE-2026-58073. Scanner output should be confirmed against the vendor advisory and installed application version.
Log indicators: Review VSPC application, authentication, enrollment, and audit logs for unexpected agent registrations, repeated enrollment attempts, duplicate agent identifiers, or credential use from unfamiliar addresses.
Behavioral anomalies: Alert when the same agent identity appears from two source addresses, when an agent authenticates from an unusual geography, or when credential retrieval is followed by unexpected console activity.
Network indicators: Examine connections to the agent-facing listener from internet addresses, unauthorized management networks, or hosts that are not associated with the expected managed endpoint. Preserve relevant logs before rotating credentials.