# Unauthenticated RCE in Veeam Service Provider Console via agent impersonation and arbitrary file write (CVE-2026-58073, CVE-2026-58072)

> Bishop Fox disclosed two chained flaws in Veeam Service Provider Console (VSPC) 9.2.1.33875 and all earlier version 9 builds. CVE-2026-58073 lets an unauthenticated network attacker impersonate a managed agent by presenting a self-signed certificate carrying the agent's GUID, and CVE-2026-58072 is an arbitrary file write that leads to remote code execution. Veeam fixed both in 9.3.0.35057 (KB4893); no in-the-wild exploitation is reported.

- **Published:** 2026-10-20T19:19:11Z
- **Last reviewed:** 2026-10-20T19:19:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3980
- **ID:** TL-2026-3980
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58073, CVE-2026-58072

## Description

VSPC exposes an agent channel (ConnectionHub) on TCP/9999 and, for Veeam Cloud Connect deployments, TCP/6180. It speaks a proprietary framed protocol carrying protobuf messages over TLS 1.2. By default the console runs in a weak certificate-authorization mode (AgentManagement_StrongCertificateAuthorization = false), so it accepts self-signed client certificates as long as the subject fields parse.

CVE-2026-58073 (CWE-287 per Bishop Fox, CWE-288 per NVD; CVSS v4.0 9.5): the handshake handler ReadAgentIdProcessorHandshakeV4.Perform calls IsLoggedIn() using only the clusteredAgentId GUID. The check asks whether any peer with that GUID has authenticated, not whether this connection belongs to that GUID. An attacker who knows a connected agent's GUID crafts a self-signed certificate with CN=<agentId>, O=<companyId>[;<clusteredAgentId>] and OU=<locationId>. The attacker connects, replaces the legitimate agent's channel, and receives an unrestricted channel with no AnonymousInterceptor. The attacker can then call IServerCertificateDispatcher.IssueCertificateForAgent and receive a PKCS#12 bundle, including the private key, signed by the console's agent root CA (CN=Veeam Software). The GUID is visible in the TLS 1.2 client certificate on the wire. It is also readable on managed endpoints from the registry (HKLM\SOFTWARE\Veeam\VAC\Agent\AgentId) and from agent logs.

CVE-2026-58072 (CWE-22; CVSS v4.0 9.0): IDownloadAcceptorPb.SaveFiles on the agent-facing receiver takes two attacker-controlled values, package.DefinedPathSubfolder and FileDataPb.FileName. They are passed to .NET Path.Combine, where a rooted second argument discards the first, so no traversal sequences are needed. The server creates any missing directory and writes the file with FileMode.Create. Writing a page into the IIS root (C:\inetpub\wwwroot) gives code execution as IIS APPPOOL\DefaultAppPool. The anonymous interceptor normally blocks this call, so the chain depends on the impersonation in 58073. Chaining needs three things: network reach to TCP/9999 (or 6180 via Cloud Connect), at least one legitimately logged-in agent, and that agent's GUID.

Veeam's patch in 9.3.0.35057 binds the login to the connection certificate thumbprint and removes the SaveFiles method, leaving six allowlisted write folders. Bishop Fox notes that patching does not revoke certificates already issued to an impersonator. The GUID also remains readable, and there is no documented agent-certificate rotation procedure. Rejecting an agent in the console installs the AnonymousInterceptor for it, and Bishop Fox recommends opening a Veeam Support case for suspected compromise. The same advisory fixes CVE-2026-58067 (unauthenticated memory-exhaustion DoS, CVSS v4.0 8.7) and CVE-2026-58071 (proxied API access as Portal Administrator in a short window after an administrator session starts, CVSS v4.0 8.2). The sources name no threat actor and report no in-the-wild exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1684.001 Impersonation
- T1649 Steal or Forge Authentication Certificates
- T1552.002 Credentials in Registry
- T1012 Query Registry
- T1505.003 Web Shell
- T1078 Valid Accounts

## Sources

- [A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console (Bishop Fox)](https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console)
- [Bishop Fox CVE-2026-58073 detection tool](https://github.com/BishopFox/CVE-2026-58073-check)
- [Veeam KB4893: Service Provider Console 9.3 security advisory](https://www.veeam.com/kb4893)
- [NVD: CVE-2026-58073](https://nvd.nist.gov/vuln/detail/CVE-2026-58073)
- [NVD: CVE-2026-58072](https://nvd.nist.gov/vuln/detail/CVE-2026-58072)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3980