Veeam SPC: Unauth API Access Post-Login
CVE-2026-58071 Published on August 4, 2026
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected Versions
Veeam Service Provider Console:- Before 9.3 is affected.