Loading story…
Veeam released security updates for Veeam Service Provider Console (VSPC) to fix two vulnerabilities tracked as CVE-2024-42448 and CVE-2024-42449. The most severe issue, CVE-2024-42448, carries a CVSS 9.9 rating and can allow a remote authenticated attacker with access to VSPC management agents to execute code on VSPC servers. The second flaw, CVE-2024-42449, is rated CVSS 7.1 and can be exploited to obtain the NTLM hash of the VSPC server service account and delete files on the server.
Affected releases include VSPC 7.0.x, 8.0.x, and 8.1.x versions earlier than 8.1.0.21999. Exploitation requires the attacker to have authorization over abused agents on the targeted VSPC server, and Veeam has directed customers to upgrade impacted systems to version 8.1.0.21999 to remediate the issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Veeam released security updates for Veeam Service Provider Console to fix two vulnerabilities: critical remote code execution flaw CVE-2024-42448 and CVE-2024-42449, which can expose the NTLM hash of the VSPC server service account and allow file deletion. Affected versions include VSPC 7.0.X, 8.0.X, and 8.1.X versions older than 8.1.0.21999, and Veeam recommended upgrading to version 8.1.0.21999.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veeam released security updates for a critical remote code execution vulnerability in **Veeam Service Provider Console (VSPC)** tracked as `CVE-2024-29212`, which carries a **CVSS 9.9** rating. The flaw stems from improper deserialization in communication between management agents and their components, allowing a remote authenticated attacker with user-level privileges to execute malicious code on VSPC servers. Affected versions include unsupported `4.0`, `5.0`, and `6.0` releases, along with `7.0` versions earlier than `7.0.0.18899` and `8.0` versions earlier than `8.0.0.19236`. After issuing an initial patch, Veeam said a subsequent review identified an additional area for improvement and released an enhanced update intended to fully mitigate the issue. The company urged customers to review its remediation guidance, upgrade impacted deployments to the fixed builds, and use only supported VSPC versions to reduce exposure.
Jul 24, 2026
Veeam disclosed multiple vulnerabilities affecting **Veeam ONE** and **Veeam Service Provider Console**, including flaws that can lead to remote code execution, authentication bypass, arbitrary file access, SQL injection, privilege escalation, and denial of service. In Veeam ONE, tracked issues include unauthenticated agent-host RCE (`CVE-2026-64633`), arbitrary file read that could aid local privilege escalation (`CVE-2026-58075`), SQL injection by a low-privileged user (`CVE-2026-64631`), server-side arbitrary code execution by a high-privileged user (`CVE-2026-58074`), and local privilege escalation to the Reporter service context (`CVE-2026-64634`). Vendor references point to advisory **KB4892** for remediation guidance. Veeam Service Provider Console versions earlier than **9.3** are also affected by several high-severity issues, including arbitrary file write leading to management-server RCE (`CVE-2026-58072`), authentication bypass allowing access to a proxied appliance API as Portal Administrator (`CVE-2026-58071`), impersonation of a managed agent to obtain credentials (`CVE-2026-58073`), and an unauthenticated denial-of-service flaw that can exhaust host memory (`CVE-2026-58067`). The Canadian Centre for Cyber Security warned that affected deployments should review Veeam guidance and apply updates, citing **KB4892** for Veeam ONE and **KB4893** for Service Provider Console; its notice lists affected versions as Veeam ONE up to **13.1.0.7034** and Service Provider Console prior to **9.3.0.35057**.
Aug 7, 2026
Veeam released security updates for multiple products after disclosing several vulnerabilities that affect enterprise backup and monitoring environments, including **Veeam Backup & Replication**, **Veeam ONE**, and **Veeam Service Provider Console**. The most severe issue, **`CVE-2026-32998`**, is a critical remote code execution flaw in Veeam Service Provider Console with a **CVSS score of 9.4**; Veeam said it is fixed in **version `9.2.1.33875`**. Canadian Centre for Cyber Security advisory **AV26-513** said affected versions include Veeam Backup & Replication 13 releases before **`13.0.2.29`**, Veeam ONE releases before **`13.0.2.6723`**, and Veeam Service Provider Console 9.2 releases before **`9.2.1.33875`**, and urged administrators to apply the vendor updates. Veeam also patched **`CVE-2026-32996`**, a high-severity local privilege escalation flaw in **Veeam Agent for Microsoft Windows** that could let a low-privileged local user gain administrative control, and **`CVE-2026-32997`**, an arbitrary file write issue affecting Linux-based backup servers running the **Veeam Software Appliance** that could allow an authenticated backup administrator to modify system files. For organizations unable to patch immediately, Veeam provided a workaround for the Service Provider Console bug by disabling the `AlarmManagement_ScriptExecution` setting in the local configuration JSON file, while older reporting on **Veeam ONE** underscores the continued security focus on Veeam’s management stack.
Jun 29, 2026