CVE-2026-32998: This vulnerability in Veeam Service Provider Console allows for remote code execution

Synopsis

A remote code execution vulnerability affects Veeam Service Provider Console versions 9.2 and earlier. The flaw is reachable over the network and requires only a low-privilege account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full code execution on the affected system, along with high-impact compromise of both the directly affected component and any connected systems. No fix version has been published; HarborGuard is tracking the advisory and will surface a patched rebuild as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted requests directly to the exposed endpoint without requiring local access.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No user action is required; the attacker can execute the attack entirely without involving another person on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory layout knowledge.

Blast Radius

• Executes arbitrary code on the Veeam Service Provider Console host, giving the attacker full control over the process and its underlying OS context.
• Reads and exfiltrates high-value data stored or accessible by the console, including backup job configurations, credentials, and managed tenant records.
• Modifies or destroys backup metadata and job definitions, undermining the integrity of managed backup workloads across connected tenants.
• Compromises connected downstream systems with high confidentiality, integrity, and availability impact, since the CVSS vector records critical scope impact on systems beyond the directly affected component.