CVE-2026-64635

CVE-2026-64635 affects Veeam Service Provider Console. An improper handling of the returnUrl parameter in Forgot Password enables an unauthenticated attacker to hijack the password-reset link domain, causing the reset code to be sent to an attacker-controlled host and potentially take over the us...

EUVD-2026-51018

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

Veeam Service Provider Console < 9.2.1.33875 (kb4856)

The version of Veeam Service Provider Console installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4856 advisory. - This vulnerability in Veeam Service Provider Console allows for remote code execution. CVE-2026-32998 Note...

CVE-2026-32998

This vulnerability in Veeam Service Provider Console allows for remote code execution...

Veeam Service Provider Console < 9.2.1.33875 (kb4853)

The version of Veeam Service Provider Console installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4853 advisory. - This vulnerability in Veeam Service Provider Console allows for remote code execution. CVE-2026-32998 Note...

CVE-2026-32998

This vulnerability in Veeam Service Provider Console allows for remote code execution...

CVE-2026-32998

Veeam Service Provider Console (VSPC) contains a critical remote code execution vulnerability (CVE-2026-32998) that affects versions prior to the fix. The CVE is addressed starting with VSPC 9.2.1.33875, per Veeam KB4853 and KB4788, which state the vulnerability was fixed and list the affected bu...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform developed by the American company Veeam. There is a security vulnerability in Veeam Service Provider Console, which may lead to remote code execution...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-29212

Due to an unsafe de-serialization method used by the Veeam Service Provider ConsoleVSPC server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution RCE on the VSPC server machine...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) users on remote and cloud-based clients stems from insufficient protection of operational data, allowing attackers to exploit this weakness to disclose sensitive information.

The vulnerability of the backup and data restoration software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information by...

Exploit for CVE-2024-42448

CVE-2024-42448-RCE Veeam Service Provider Console VSPC rem...

Veeam Service Provider Console < 8.1.0.21999 Multiple Vulnerabilities (kb4679)

The version of Veeam Service Provider Console installed on the remote host is prior to 8.1.0.21999. It is, therefore, affected by multiple vulnerabilities as referenced in the kb4679 advisory. - From the VSPC management agent machine, under the condition that the management agent is authorized on...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

The CVE-2024-45206 issue affects Veeam Service Provider Console (SPC) up through 8.0.x. It allows an attacker to perform arbitrary HTTP requests to arbitrary hosts in the network and access information about internal resources. Remediation: upgrade to Veeam Service Provider Console 8.1.0.21377 or...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in the Veeam Service Provider Console that originates from allowing arbitrary HTTP requests to be performed on arbitrary hosts on the network and obtain information about internal resources...

PT-2024-9161 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC versions prior to 8.1.0.21377 Description: The issue is related to access control errors in the Veeam Service Provider Console VSPC backup and restore software for remote and cloud clients. It allows a remo...