CVE-2026-32998

The vulnerability classified as CWE-233 (Improper Handling of Parameters) allows an attacker to execute arbitrary code remotely on the vulnerable system. Network attack vector (AV:N) without requiring user interaction (UI:N) with low privilege requirements (PR:L) means that basic access to the console is sufficient to conduct a successful attack. The vulnerability affects both resources of the target system and related systems (SC:H/SI:H/SA:H).

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely, which can lead to complete system takeover, data theft, and compromise of integrity and availability of both the target system and related systems.

Patches available from the vendor should be applied in accordance with references published at https://www.veeam.com/kb4853. Until patches are deployed, it is recommended to restrict network access to Veeam Service Provider Console exclusively to trusted hosts and monitor logs for unauthorized activities.

Veeam Service Provider Console — versions indicated in vendor references (https://www.veeam.com/kb4853)