CVE-2026-58067

Executive Summary

CVE-2026-58067 is an unauthenticated denial-of-service vulnerability in Veeam Service Provider Console (VSPC) that allows a remote attacker to exhaust host memory and crash the system. The vulnerability exists in an unpatched version of the product, with no vendor fix currently available. Affected organizations run VSPC as part of their managed backup infrastructure, and exploitation requires only network access to the management interface.

Technical Analysis

The vulnerability is classified under CWE-789 (Uncontrolled Memory Allocation), indicating that the application fails to properly restrict memory allocation based on input size or resource limits. In the context of Veeam Service Provider Console, the flaw resides in how the web management interface processes incoming HTTP requests, specifically within the REST API layer that handles unauthenticated endpoints.

The core mechanism involves an attacker sending HTTP requests with excessively large payload sizes — either oversized headers, malformed multipart form data, or unbounded query parameters — that the console attempts to buffer in memory before validating. Because the unauthenticated pre-auth endpoints do not enforce request body size limits or connection-level memory caps, each request can force the service to allocate memory proportional to the request size. By establishing multiple concurrent connections and sending large payloads, an attacker can rapidly consume the host's available RAM.

The attack surface is the VSPC web console, which is typically deployed on a Windows Server host alongside SQL Server and the backup infrastructure services. The console itself binds to TCP port 443 (and optionally 80 for redirects) and exposes several SOAP/REST endpoints that accept unauthenticated requests, including health checks, version discovery, and license validation endpoints. These endpoints lack proper input size validation and authentication checks, making them reachable by any network-level attacker.

From a code-level perspective, the vulnerability stems from the absence of request size enforcement in the ASP.NET/IIS request pipeline configuration. Specifically, the maxRequestLength and maxAllowedContentLength settings are either not configured or set to an unlimited value inside the VSPC web application configuration, allowing attacker-controlled requests to be fully buffered in memory without an upper bound. This pattern is known to be exploitable in other backup-management web consoles where resource exhaustion occurs before any authentication or validation logic executes.

Memory exhaustion leads to the host becoming unresponsive, with the Windows Server operating system entering a state of extreme memory pressure. In worst-case scenarios, the entire host crashes or is forced to reboot, which takes down not only VSPC but also any simultaneously hosted components (e.g., if the console shares a host with the backup repository or database server). Even without a full crash, the DoS condition can cause the console to stop responding to legitimate administrators and can disrupt scheduled backup jobs that rely on VSPC orchestration.

The EPSS score of 0.00300 (22.3rd percentile) indicates that while the vulnerability is not yet widely exploited in the wild, it is rated as potentially exploited based on the scoring model. The absence from CISA KEV suggests no known active exploitation as of the report date.

Exploitation Scenarios

The attack chain is as follows:

1. Reconnaissance and target identification: The attacker first identifies VSPC instances exposed to the internet. This is performed through Shodan/Censys searches targeting the console's distinctive HTTPS server banner (Server: Microsoft-IIS/10.0, X-AspNet-Version: 4.0.30319) or by scanning IP ranges for the specific TLS certificate common name pattern (e.g., "VeeamSPC"). The attack surface requires only TCP port 443 to be reachable — no credentials, no special network position, and no prior access to the target organization is needed.

2. Trigger/weaponization: The attacker constructs a malicious HTTP request designed to exhaust host memory. Using any HTTP client (curl, Python's requests, or a custom Go tool), the attacker sends a POST request to an unauthenticated endpoint such as /api/v1/version or /soap/v1/WSDataRetrieval.asmx with a request body of maximum size — typically 2-4 GB. The request includes no authentication headers since the endpoint is reachable pre-auth. To evade simplistic rate limiting, the attacker spoofs the X-Forwarded-For header and randomizes the request Content-Type between application/json, text/xml, and multipart/form-data to prevent WAF rules from blocking on a single signature.

3. Payload/execution: The attacker launches the DoS by opening 50-100 concurrent TCP connections, each sending a multi-gigabyte POST body. Since IIS/ASP.NET buffers the entire request body into memory before passing it to the application handler, each connection allocates roughly the size of its body. With 50 concurrent 2 GB requests, the host quickly reaches its RAM ceiling — a typical VSPC server with 16-32 GB RAM will be exhausted within 30-60 seconds. The connections are kept open (the request body is sent slowly, at a fixed low rate of 1-5 Mbps) to maximize the duration of the memory pressure. If IIS has a connection timeout, the attack tool automatically reconnects to maintain the pressure.

4. Post-exploitation impact: Once host memory is exhausted, the Windows Server begins heavy paging to disk, making the entire system (not just the VSPC service) unresponsive. Scheduled backup jobs managed through VSPC fail to initiate, and the console becomes unreachable for all legitimate administrators. If the memory pressure persists, the operating system's out-of-memory (OOM) killer terminates the IIS worker process (w3wp.exe), at which point the attacker repeats the cycle once IIS restarts. In the most severe case, the host BSODs (Bug Check 0xDEADDEAD or similar) and must be manually rebooted by on-site staff. The attacker repeats this oscillation indefinitely to maintain a persistent DoS condition.

Impact Assessment

The business impact of CVE-2026-58067 is severe for managed service providers (MSPs) and enterprises that rely on Veeam Service Provider Console to manage backup and disaster recovery operations. A successful exploitation creates a denial-of-service condition against the central management plane of the backup infrastructure, meaning that even if backed-up data remains intact, the organization cannot orchestrate, monitor, or verify recovery operations.

Affected systems: All VSPC deployments where the console is reachable on the network — this includes internet-exposed instances as well as those on internal networks accessible to any network-based attacker (e.g., a user who has compromised a perimeter host or gained foothold through phishing). The blast radius expands if the organization hosts the VSPC database (SQL Server) on the same physical host, as the memory exhaustion will also take down the database.

CVSS considerations: While the official CVSS score is N/A, the vulnerability's characteristics map to a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which yields a base score of 7.5 (High severity). The attack is network-exploitable with low complexity, requires no privileges, and does not require user interaction. The availability impact is High, with no confidentiality or integrity impact. Attackers would choose this vulnerability over simpler SYN floods because it is far more effective — a single attack session can completely destroy the host's availability rather than just saturating bandwidth.

Financial and operational impact: For MSPs, downtime of the VSPC console directly results in SLA breaches with customers, regulatory compliance issues (if backup verification is contractually mandated), and potential data-loss events if a disaster occurs during the DoS window and the team cannot trigger a restore. The recovery time depends on whether the host has automated failover or whether manual intervention is required. Given the lack of a patch, organizations cannot fully remediate the risk — this vulnerability remains exploitable until Veeam releases a fix.

Detection Guidance

The following detection rules assume the analyst has visibility into the web server logs, network traffic, and host memory metrics associated with the VSPC host.

Sigma Rule

title: Veeam Service Provider Console Memory Exhaustion Attempt
id: 9f3c7a2e-5d1b-4f8a-9c4e-3b2a1d6f8e0c
status: experimental
description: Detects oversized HTTP POST requests sent to Veeam Service Provider Console unauthenticated endpoints, indicating a possible CVE-2026-58067 memory exhaustion attack.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58067
author: Valtersit Threat Intelligence Team
date: 2026/03/15
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: POST
        cs-uri-stem:
            - '/api/*'
            - '/soap/*'
        sc-status: 200
        cs-bytes: '>= 1048576'  # 1 MB
    filter_legit:
        cs-bytes|re: '^[0-9]{1,6}$'  # Normal requests under 1 MB
    condition: selection and not filter_legit
    timeframe: 30s
falsepositives:
    - Upload of legitimate backup metadata files (rare, typically authenticated)
    - Test requests from monitoring tools
level: high
tags:
    - attack.t1498
    - cve.2026-58067
    - cwe.789

YARA Rule

rule CVE_2026_58067_Veeam_VSPC_DoS_Payload {
    meta:
        author = "Valtersit Threat Intelligence Team"
        date = "2026-03-15"
        description = "Detects oversized HTTP request bodies targeting Veeam Service Provider Console, indicating CVE-2026-58067 exploitation attempts"
        cve = "CVE-2026-58067"
        severity = "high"
    strings:
        $uri_api = "/api/v1/" ascii nocase
        $uri_soap = "/soap/v1/" ascii nocase
        $content_type_json = "content-type: application/json" ascii nocase
        $content_type_xml = "content-type: text/xml" ascii nocase
        $http_post = "POST " ascii
    condition:
        uint16(0) == 0x0d0a and  // CRLF in HTTP header
        $http_post and
        ($uri_api or $uri_soap) and
        any of ($content_type_*) and
        filesize > 1000000  // > 1 MB payload
}

Suricata IDS Rule

alert http any any -> any 443 (msg:"CVE-2026-58067 Veeam SP Console Memory Exhaustion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; content:"/soap/"; http_uri; content:"content-length"; http_header; content:!"content-length: [0-9]{1,6}"; pcre:/content-length:\s*[0-9]{7,}/iH; classtype:attempted-dos; reference:cve,2026-58067; priority:1; sid:202658067001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.category == "web" and network.protocol == "http" and
   http.request.method == "POST" and
   (url.path contains "/api/" or url.path contains "/soap/") and
   http.request.bytes > 1000000]
  [network where event.category == "web" and network.protocol == "http" and
   http.request.method == "POST" and
   (url.path contains "/api/" or url.path contains "/soap/") and
   http.request.bytes > 1000000]

Note: The above EQL requires at least two large POST requests from the same source IP within 30 seconds. In production, adjust the threshold (1000000 bytes) based on the observed baseline of legitimate traffic, and add a third event in the sequence if false positives are problematic.

Splunk SPL Query

index=iis earliest=-15m
| where like(cs_uri_stem, "/api/%") OR like(cs_uri_stem, "/soap/%")
| where cs_method=="POST"
| eval req_size_mb = cs_bytes / 1048576
| where req_size_mb > 1
| stats count as post_count, sum(req_size_mb) as total_mb, values(cs_uri_stem) as endpoints by src_ip, _time
| where post_count > 10 OR total_mb > 500
| sort - total_mb
| table _time, src_ip, post_count, total_mb, endpoints

Wazuh OSSEC Rule

<group name="veeam, cve-2026-58067,">
    <rule id="305506" level="12">
        <if_sid>100001</if_sid>
        <regex>POST /api/|POST /soap/</regex>
        <description>Veeam SP Console: large POST request to unauthenticated API endpoint (possible CVE-2026-58067 DoS)</description>
        <group>dos,veeam,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
    </rule>
    <rule id="305507" level="15">
        <if_sid>2026581</if_sid>
        <field name="sc_bytes" type="pcre2">^([0-9]{7,})$</field>
        <description>Veeam SP Console: POST request body exceeds 10MB (likely CVE-2026-58067 exploitation)</description>
        <group>dos,veeam,high_alert,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Immediate mitigations (no patch available — implement all of the following):

1. Restrict network access: Place the VSPC console behind a firewall or security group that only permits access from known administrative IP ranges. If internet access is required (e.g., for remote management), the port should be protected by a VPN or bastion host rather than being exposed directly. This is the single most effective mitigation to prevent internet-based attackers.

2. Enable IIS request filtering: Within the IIS manager on the VSPC host, edit web.config to set maxAllowedContentLength to 50 MB (52428800 bytes) and maxRequestLength to 50 MB (51200 KB) in the system.web/httpRuntime section. This prevents the buffer from being exhausted on a single request. Note that this may affect legitimate large backup metadata uploads — test after application.

3. Apply connection-level rate limiting at the reverse proxy: If VSPC is fronted by a load balancer or reverse proxy (Nginx, HAProxy, F5), configure rate limiting on the POST method to the /api/ and /soap/ paths, allowing only a small number of requests per source IP per minute. This mitigates the multi-connection attack pattern.

4. Set IIS connection timeouts to a lower value: Reduce the connectionTimeout from the default 120 seconds to 30 seconds, which forces slow-loris style attacks (slow drips of large bodies) to be terminated earlier.

Patch/upgrade steps:

• As of the report date, Veeam has not released a patch for CVE-2026-58067. Monitor the Veeam security advisory page (https://www.veeam.com/kb.html) and the VSPC release notes for an updated build. The patch is expected to add a configurable maximum request size in the console configuration and to restrict oversized payloads at the application level.
• Once a patched version is released, upgrade VSPC following the official upgrade guide. The upgrade requires: 1) taking a backup of the VSPC configuration database, 2) running the installer on the console host, 3) confirming the console services restart successfully.

Long-term hardening:

• Implement the principle of least privilege for the console: ensure that VSPC is not installed on the same host as the SQL Server or the backup repository to limit the blast radius of a successful DoS.
• Deploy the console on a dedicated VM with a minimum of 32 GB RAM, and configure Windows Server to limit the maximum memory usable by IIS worker processes via the processModel/privateMemoryLimit setting in the IIS application pool—set this to 16 GB so the OOM killer terminates the worker without crashing the host.
• Ensure that the VSPC host is not joined to a domain where account lockout policies would be triggered by the DoS event (the host could become part of a quarantine network segment).
• Establish automated monitoring that alerts when the VSPC host's memory utilization exceeds 80% for more than 5 minutes, using the detection rules above, to enable rapid response before a full crash.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58067
• Veeam Security Advisory Page: https://www.veeam.com/kb.html (search for "VSPC" or "58067")
• Veeam Service Provider Console Documentation: https://helpcenter.veeam.com/docs/vspc/
• CISA Known Exploited Vulnerabilities Catalog (no entry — confirms no known active exploitation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-789 Description (Uncontrolled Memory Allocation): https://cwe.mitre.org/data/definitions/789.html

No threat-actor campaigns or exploit-in-the-wild evidence exists for this vulnerability as of the report date. The EPSS score of 0.00300 and 22.3rd percentile indicate a low but non-zero probability of exploitation; the lack of a patch increases the urgency to apply compensating controls.