A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console
Bishop Fox demonstrated that a combination of two critical vulnerabilities in Veeam Service Provider Console allows attackers to achieve unauthenticated remote code execution without any prior credentials. CVE-2026-58073 permits an attacker to impersonate a connected backup agent to steal its certificate, while CVE-2026-58072 enables arbitrary file writes using that stolen identity. By chaining these flaws, researchers achieved full control over the console server running version 9.2.1. Organizations must upgrade to Veeam Service Provider Console 9.3.0 immediately and review logs for signs of exploitation.
TL;DR
CVE-2026-58073">CVE-2026-58073 (CVSS 9.5) and CVE-2026-58072">CVE-2026-58072 (CVSS 9.0) are critical vulnerabilities in Veeam Service Provider Console, the multi-tenant console that managed service providers use to run backups across all of their customers. The first lets an unauthenticated network peer claim a connected backup agent’s identity and receive that agent’s real certificate. The second lets anything holding an agent certificate write a file anywhere on the server. Chained, they are unauthenticated remote code execution on the console that sits above every tenant’s backups, which we proved end to end against Veeam’s own binaries. Patch to 9.3.0, then check your logs for indicators of compromise. Bishop Fox has published a CVE-2026-58073-check">safe detection tool.…