Loading story…
Veeam released security updates for a critical remote code execution vulnerability in Veeam Service Provider Console (VSPC) tracked as CVE-2024-29212, which carries a CVSS 9.9 rating. The flaw stems from improper deserialization in communication between management agents and their components, allowing a remote authenticated attacker with user-level privileges to execute malicious code on VSPC servers. Affected versions include unsupported 4.0, 5.0, and 6.0 releases, along with 7.0 versions earlier than 7.0.0.18899 and 8.0 versions earlier than 8.0.0.19236.
After issuing an initial patch, Veeam said a subsequent review identified an additional area for improvement and released an enhanced update intended to fully mitigate the issue. The company urged customers to review its remediation guidance, upgrade impacted deployments to the fixed builds, and use only supported VSPC versions to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On May 28, 2024, Veeam released an enhanced update for Veeam Service Provider Console after a later review identified an additional area for improvement beyond the initial fix. The refined patch was intended to fully mitigate CVE-2024-29212, and customers were advised to update their deployments.
On May 7, 2024, Veeam issued an initial patch for the critical Veeam Service Provider Console vulnerability CVE-2024-29212. The flaw is a remote code execution issue caused by improper deserialization in communications between management agents and their components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veeam released security updates for **Veeam Service Provider Console (VSPC)** to fix two vulnerabilities tracked as `CVE-2024-42448` and `CVE-2024-42449`. The most severe issue, `CVE-2024-42448`, carries a **CVSS 9.9** rating and can allow a remote authenticated attacker with access to VSPC management agents to execute code on VSPC servers. The second flaw, `CVE-2024-42449`, is rated **CVSS 7.1** and can be exploited to obtain the **NTLM hash** of the VSPC server service account and delete files on the server. Affected releases include **VSPC 7.0.x, 8.0.x, and 8.1.x** versions earlier than **8.1.0.21999**. Exploitation requires the attacker to have authorization over abused agents on the targeted VSPC server, and Veeam has directed customers to upgrade impacted systems to **version 8.1.0.21999** to remediate the issues.
Jul 24, 2026
Veeam released security updates for multiple products after disclosing several vulnerabilities that affect enterprise backup and monitoring environments, including **Veeam Backup & Replication**, **Veeam ONE**, and **Veeam Service Provider Console**. The most severe issue, **`CVE-2026-32998`**, is a critical remote code execution flaw in Veeam Service Provider Console with a **CVSS score of 9.4**; Veeam said it is fixed in **version `9.2.1.33875`**. Canadian Centre for Cyber Security advisory **AV26-513** said affected versions include Veeam Backup & Replication 13 releases before **`13.0.2.29`**, Veeam ONE releases before **`13.0.2.6723`**, and Veeam Service Provider Console 9.2 releases before **`9.2.1.33875`**, and urged administrators to apply the vendor updates. Veeam also patched **`CVE-2026-32996`**, a high-severity local privilege escalation flaw in **Veeam Agent for Microsoft Windows** that could let a low-privileged local user gain administrative control, and **`CVE-2026-32997`**, an arbitrary file write issue affecting Linux-based backup servers running the **Veeam Software Appliance** that could allow an authenticated backup administrator to modify system files. For organizations unable to patch immediately, Veeam provided a workaround for the Service Provider Console bug by disabling the `AlarmManagement_ScriptExecution` setting in the local configuration JSON file, while older reporting on **Veeam ONE** underscores the continued security focus on Veeam’s management stack.
Jun 29, 2026
Veeam released security updates for multiple products, including **Backup & Replication**, **Service Provider Console**, **Veeam ONE**, **Agent for Linux**, and several backup plug-ins, to fix a set of critical and high-severity vulnerabilities. The most severe issue, **`CVE-2024-40711`**, is a critical unauthenticated remote code execution flaw in **Veeam Backup & Replication** with a **CVSS 9.8** rating, allowing attackers to potentially compromise backup servers without logging in. The broader patch set also addresses weaknesses that could enable credential theft, backup manipulation, MFA bypass, privilege escalation, SSRF exploitation, and additional remote code execution in other Veeam components. Security advisories urged organizations to upgrade immediately to fixed versions, warning that backup infrastructure is a high-value target and that successful exploitation could materially increase ransomware risk by giving attackers access to recovery systems.
Jul 24, 2026