Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant...

CVE-2026-58073

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-58067

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

CVE-2026-58073

Technical details about CVE-2026-58073 are not publicly available in the provided documents. No specifics on affected versions, root cause, or remediation are given. Monitor for updates from Veeam and CVE records.

OAuth interaction_required Error in Veeam Backup & Replication Console After Veeam Software Appliance Update

Challenge The Veeam Backup & Replication Console displays the following error when attempting to connect to a Veeam Software Appliance that was recently updated: Unable to perform OAuth authorization: interactionrequired. The Veeam Backup & Replication Console will report that it successfully...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.1 that originates from a remote code execution that can be performed by a management agent machine on a VSPC server machine with server...

The vulnerability of the backup and data restoration software for Veeam Service Provider Console (VSPC) clients that are located remotely or in the cloud lies in access control errors. This allows a malicious actor to delete any files on the VSPC server at will.

The vulnerability of the backup and data recovery software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to access control errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to delete any files on the VSPC server at...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) users on remote and cloud-based clients stems from errors in privilege management. This vulnerability allows a malicious actor to execute arbitrary code.

The vulnerability of the backup and data recovery software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to errors in privilege management. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from contains a code injection vulnerability that allows a low-privileged user to overwrite files o...

AHV clusters with AOS versions 5.20.4+ (LTS) or 6.1.1+ (STS) shown as unavailable in Veeam Console

Challenge If the machine where Veeam Backup & Replication is installed is running Windows Server 2012R2 OS or earlier, and the Nutanix AHV Clusters are running AOS versions 5.20.4+ LTS or 6.1.1+ STS, the following may occur: Nutanix Clusters that were previously added to Veeam Backup & Replicatio...