A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console
PoC publicVeeam Service Provider ConsoleOur summary
Bishop Fox demonstrated that a combination of two critical vulnerabilities in Veeam Service Provider Console allows attackers to achieve unauthenticated remote code execution without any prior credentials. CVE-2026-58073 permits an attacker to impersonate a connected backup agent to steal its certificate, while CVE-2026-58072 enables arbitrary file writes using that stolen identity. By chaining these flaws, researchers achieved full control over the console server running version 9.2.1. Organizations must upgrade to Veeam Service Provider Console 9.3.0 immediately and review logs for signs of exploitation.
Below is the opening; the full story is at Bishop Fox.
From Bishop Fox
TL;DR
CVE-2026-58073">CVE-2026-58073 (CVSS 9.5) and CVE-2026-58072">CVE-2026-58072 (CVSS 9.0) are critical vulnerabilities in Veeam Service Provider Console, the multi-tenant console that managed service providers use to run backups across all of their customers. The first lets an unauthenticated network peer claim a connected backup agent’s identity and receive that agent’s real certificate. The second lets anything holding an agent certificate write a file anywhere on the server. Chained, they are unauthenticated remote code execution on the console that sits above every tenant’s backups, which we proved end to end against Veeam’s own binaries. Patch to 9.3.0, then check your logs for indicators of compromise. Bishop Fox has published a CVE-2026-58073-check">safe detection tool.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.