Threat reportVulnerabilityTL-2026-3980
Unauthenticated RCE in Veeam Service Provider Console via agent impersonation and arbitrary file write (CVE-2026-58073, CVE-2026-58072)
Unauthenticated RCE in Veeam Service Provider Console via (TL-2026-3980), also tracked as A GUID is Not a Credential, is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-10-20. It has no confirmed attribution, affects Veeam Service Provider Console (VSPC), references 2 CVEs (CVE-2026-58073, CVE-2026-58072), maps to 7 MITRE ATT&CK techniques (T1012, T1078, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3980
- Threat ID
- TL-2026-3980
- Also known as
- A GUID is Not a Credential
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- managed service providers, technology, cloud services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Unauthenticated RCE in Veeam Service Provider Console via
Malware and tooling: CVE-2026-58073-check
How Unauthenticated RCE in Veeam Service Provider Console via works
Bishop Fox disclosed two chained flaws in Veeam Service Provider Console (VSPC) 9.2.1.33875 and all earlier version 9 builds. CVE-2026-58073 lets an unauthenticated network attacker impersonate a managed agent by presenting a self-signed certificate carrying the agent's GUID, and CVE-2026-58072 is an arbitrary file write that leads to remote code execution. Veeam fixed both in 9.3.0.35057 (KB4893); no in-the-wild exploitation is reported.
VSPC exposes an agent channel (ConnectionHub) on TCP/9999 and, for Veeam Cloud Connect deployments, TCP/6180. It speaks a proprietary framed protocol carrying protobuf messages over TLS 1.2. By default the console runs in a weak certificate-authorization mode (AgentManagement_StrongCertificateAuthorization = false), so it accepts self-signed client certificates as long as the subject fields parse.
CVE-2026-58073 (CWE-287 per Bishop Fox, CWE-288 per NVD; CVSS v4.0 9.5): the handshake handler ReadAgentIdProcessorHandshakeV4.Perform calls IsLoggedIn() using only the clusteredAgentId GUID. The check asks whether any peer with that GUID has authenticated, not whether this connection belongs to that GUID. An attacker who knows a connected agent's GUID crafts a self-signed certificate with CN=<agentId>, O=<companyId>[;<clusteredAgentId>] and OU=<locationId>. The attacker connects, replaces the legitimate agent's channel, and receives an unrestricted channel with no AnonymousInterceptor. The attacker can then call IServerCertificateDispatcher.IssueCertificateForAgent and receive a PKCS#12 bundle, including the private key, signed by the console's agent root CA (CN=Veeam Software). The GUID is visible in the TLS 1.2 client certificate on the wire. It is also readable on managed endpoints from the registry (HKLM\SOFTWARE\Veeam\VAC\Agent\AgentId) and from agent logs.
CVE-2026-58072 (CWE-22; CVSS v4.0 9.0): IDownloadAcceptorPb.SaveFiles on the agent-facing receiver takes two attacker-controlled values, package.DefinedPathSubfolder and FileDataPb.FileName. They are passed to .NET Path.Combine, where a rooted second argument discards the first, so no traversal sequences are needed. The server creates any missing directory and writes the file with FileMode.Create. Writing a page into the IIS root (C:\inetpub\wwwroot) gives code execution as IIS APPPOOL\DefaultAppPool. The anonymous interceptor normally blocks this call, so the chain depends on the impersonation in 58073. Chaining needs three things: network reach to TCP/9999 (or 6180 via Cloud Connect), at least one legitimately logged-in agent, and that agent's GUID.
Veeam's patch in 9.3.0.35057 binds the login to the connection certificate thumbprint and removes the SaveFiles method, leaving six allowlisted write folders. Bishop Fox notes that patching does not revoke certificates already issued to an impersonator. The GUID also remains readable, and there is no documented agent-certificate rotation procedure. Rejecting an agent in the console installs the AnonymousInterceptor for it, and Bishop Fox recommends opening a Veeam Support case for suspected compromise. The same advisory fixes CVE-2026-58067 (unauthenticated memory-exhaustion DoS, CVSS v4.0 8.7) and CVE-2026-58071 (proxied API access as Portal Administrator in a short window after an administrator session starts, CVSS v4.0 8.2). The sources name no threat actor and report no in-the-wild exploitation.
MITRE ATT&CK techniques used in TL-2026-3980
Discovery
Persistence
T1078 Valid Accounts; T1505.003 Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.002 Credentials in Registry; T1649 Steal or Forge Authentication Certificates
Defense Evasion
Affected products and versions in Unauthenticated RCE in Veeam Service Provider Console via
- Veeam — Service Provider Console (VSPC)
Vulnerable versions: 9.2.1.33875 and all earlier version 9 builds
Fixed in: 9.3.0.35057 and later
Remediation for Unauthenticated RCE in Veeam Service Provider Console via
Patches
- Veeam KB4893: VSPC 9.3.0.35057 fixes CVE-2026-58073, CVE-2026-58072, CVE-2026-58067 and CVE-2026-58071
Immediate actions
- Upgrade VSPC to 9.3.0.35057 or later (no 9.2.x backport exists)
- Restrict TCP/9999 to agent subnets only; note that Cloud Connect gateway TCP/6180 can forward to 9999
- Run the Bishop Fox CVE-2026-58073-check detector against all VSPC consoles
- Search VSPC logs under %ProgramData%\Veeam\Veeam Availability Console\Log\ for the exploitation signatures listed in the IOCs
Workarounds
- Restrict network access to TCP/9999 and TCP/6180 (partial mitigation only)
- Reject suspect agents in the console, which installs the AnonymousInterceptor (disables SLA tracking for that agent and is irreversible)
Longer-term hardening
- Baseline and monitor certificate issuance (IssueCertificateForAgent) on agent connections
- Do not expose the VSPC agent channel to untrusted networks
- Escalate any suspected agent impersonation to Veeam Support because patching does not revoke already-issued agent certificates
CVEs associated with Unauthenticated RCE in Veeam Service Provider Console via
Weaknesses (CWE) in Unauthenticated RCE in Veeam Service Provider Console via
Timeline of Unauthenticated RCE in Veeam Service Provider Console via
- KB4893 also fixes CVE-2026-58067 (unauthenticated memory-exhaustion DoS, CVSS v4.0 8.7) and CVE-2026-58071 (Portal Administrator API access during session initialization, CVSS v4.0 8.2), both found in Veeam internal testing.
- NVD publishes CVE-2026-58073 (CVSS v4.0 9.5) and CVE-2026-58072 (CVSS v4.0 9.0), both marked as affecting VSPC versions before 9.3.
- Veeam publishes advisory KB4893 and releases VSPC 9.3.0.35057, fixing CVE-2026-58073, CVE-2026-58072, CVE-2026-58067 and CVE-2026-58071. The first two were reported via HackerOne.
- Veeam KB4893 is last modified.
- Bishop Fox releases the CVE-2026-58073-check scanner, which uses the ConnectionHub protocol v6/v7 handshake discriminator over TCP/9999 and TCP/6180 and leaves bf-probe-<uuid4> receiver names in ConnectionHub.log.
- Bishop Fox publishes 'A GUID is Not a Credential', with the full impersonation and file-write chain demonstrated on isolated 9.2.0 and 9.2.1 labs, log signatures, and the CVE-2026-58073-check detection tool.
- NVD last modifies CVE-2026-58073, now listing CWE-288. The record is still awaiting analysis.
Sources cited for Unauthenticated RCE in Veeam Service Provider Console via
Detection coverage for TL-2026-3980
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3980 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.