CVE-2026-58067

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

CVE-2026-58073

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-58073

Technical details about CVE-2026-58073 are not publicly available in the provided documents. No specifics on affected versions, root cause, or remediation are given. Monitor for updates from Veeam and CVE records.

CVE-2026-58073

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

EUVD-2026-52752

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-58067

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

PT-2026-67756

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description An unauthenticated attacker can exhaust host memory, leading to a denial of service. Denial of service is a condition where a system becomes unavailable to its intended...

CVE-2026-58071: Missing Authentication for Critical Function

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

Vulnerabilities Resolved in Veeam Service Provider Console 9.3

All vulnerabilities documented in this article were resolved in Veeam Service Provider Console 9.3.0.35057. Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure...

PT-2026-67758

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description A flaw allows an attacker to perform an arbitrary file write on the management server, which can potentially lead to remote code execution RCE, a situation where an...

PT-2026-67759

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description An unauthenticated attacker can impersonate a managed agent to obtain the credentials of that agent. Recommendations At the moment, there is no information about a newe...

CVE-2026-58067: Memory Allocation with Excessive Size Value

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service...

CVE-2026-58073: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials...

CVE-2026-58072: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-67357

ArcadeDB before 26.7.3 has an information-disclosure vulnerability in the MCP get_server_settings tool that leaks arcadedb.ha.clusterToken in cleartext. With MCP access, an attacker can use the cluster token via X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root an...

CVE-2026-67208

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

CVE-2026-67208 Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...