A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console

Vendor

Veeam

Product

Veeam Service Provider Console

Affected versions

before 9.3.0

CVSS

9.8

Published

2026-08-26 00:00

Collected

2026-08-26 18:25

---
id: 6742
title: "A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console"
cvss: 9.8
severity: critical
vendor: "Veeam"
product: "Veeam Service Provider Console"
affected_versions: "before 9.3.0"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console"
published_at: "2026-08-26T00:00:00Z"
tags: ["rce", "backup-security", "authentication", "vulnerability", "cve", "security-research", "veeam", "cve-2026-58073", "cve-2026-58072"]
phying_url: "https://phying.com/item/6742"
lang: en
---

# A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console

## Summary

Bishop Fox proves unauthenticated RCE in Veeam Service Provider Console by chaining CVE-2026-58073 (CVSS 9.5, agent impersonation) with CVE-2026-58072 (CVSS 9.0, arbitrary file write); patch to 9.3.0 and check logs with the provided safe detection tool, which also covers two sibling CVEs.

## Why it matters

This critical vulnerability chain allows unauthenticated take-over of backup control planes across multi-tenant deployments.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVSS:** 9.8
- **Vendor:** Veeam
- **Product:** Veeam Service Provider Console
- **Affected versions:** before 9.3.0
- **Published:** 2026-08-26T00:00:00Z
- **Original:** https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console
- **Phying News:** https://phying.com/item/6742