Advisory severityCritical9.5Veeam

Critical [CVE-2026-58067 +3] Vulnerabilities Resolved in Veeam Service Provider Console 9.3

This critical-severity Veeam advisory covers CVE-2026-58067 and CVE-2026-58071 and 2 more CVEs.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 4 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.

KB4893 Source published Aug 4, 2026

VulniPulse record published Aug 4, 2026Record updated Aug 10, 2026

CVE-2026-58067 CVE-2026-58071 CVE-2026-58072 CVE-2026-58073

Monitor future Veeam CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Vulnerabilities Resolved in Veeam Service Provider Console 9.3

KB ID: 4893

Product:

Published: 2026-08-04

Last Modified:

Veeam Software Security Commitment

Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits.

When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.

This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software.

This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.

Issue Details

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials.

Severity: Critical

Affected versions

9.2.1.33875

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Fixed versions

9.3.0

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade to Veeam Service Provider Console 9.2.1.33875 or later, which contains the listed security fixes.

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Veeam Knowledge Base — Security Advisoriesofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://www.veeam.com/kb_rss; this link opens the Veeam advisory index instead of the raw feed document.
Veeam
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Veeam

Cross-references

Validate CVE metadata against the authoritative registries.

Official resources

Veeam Service Provider Console downloads (target: 9.3.0)
Official documentation
This advisory names 9.3.0 as the first fixed release — official upgrade documentation for Veeam Service Provider Console.
Veeam Knowledge Base (advisory source)
Official documentation
Canonical Veeam KB — the authoritative advisory text, affected builds and hotfixes.
Veeam Trust Center
Official documentation
Veeam's security and vulnerability-disclosure hub.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.