CVE-2026-58072

Executive Summary

CVE-2026-58072 is a critical arbitrary file write vulnerability in the Veeam Service Provider Console (VSPC) management server. Successful exploitation enables unauthenticated remote code execution (RCE) with SYSTEM privileges on the management server, which is the central control plane for multi-tenant backup environments. This flaw affects all VSPC deployments that expose the management web interface to reachable networks. Given the architecture of VSPC (which often holds credentials and schedules backups for hundreds of tenant environments), the impact is severe — a compromise of the management server effectively grants attackers control over the entire backup infrastructure and its associated tenant data.

Technical Analysis

The vulnerability resides in the VSPC management server's file upload and REST API handling routines. The core issue is a classic directory traversal flaw (CWE-22) within an arbitrary file write primitive. The affected endpoint fails to sanitize user-supplied file paths or filenames containing traversal sequences (e.g., ../ or encoded variants such as ..%2f).

Attack Surface:

• The vulnerable component is the VSPC Management Portal, typically listening on HTTPS port 443 (configurable) and reachable via the /api and /console virtual directories.
• The file write is triggered via an HTTP PUT or POST request to specific API endpoints that handle package uploads, logo/theme customization, or report generation — all of which persist files to the server filesystem.
• The management server runs as a Windows service under the NT AUTHORITY\SYSTEM account (default installation), making the write primitive exceptionally powerful.

Vulnerability Mechanism:

1. The request handler takes user-controlled input, either a filename parameter or a multipart form field, and concatenates it with a base directory path (e.g., C:\Program Files\Veeam\VSPC\Web\).
2. No validation is performed to ensure the resolved path remains within the intended base directory.
3. By injecting traversal sequences (..\..\..\Windows\System32\drivers\etc\hosts or ..\..\..\inetpub\wwwroot\shell.aspx), an attacker can write arbitrary content to any location on the filesystem that the SYSTEM account can write to — effectively the entire disk.
4. The write operation is unauthenticated, meaning no session cookie or API token is required.

Code-Level Relevance (inferred from patch diffs of analogous VSPC vulnerabilities):

// Vulnerable pattern:
string filePath = Path.Combine(uploadDirectory, request["filename"]);
File.WriteAllBytes(filePath, uploadData);

// Corrected pattern:
string fileName = Path.GetFileName(request["filename"]);
if (fileName.Contains("..")) throw new ArgumentException();
string filePath = Path.Combine(uploadDirectory, fileName);

The patched version would use Path.GetFileName to strip traversal components and reject any path containing parent directory references.

Key Technical Details:

• Protocol: HTTPS
• Authentication: Not required
• Scope: Management server filesystem (full write access under SYSTEM)
• Chained impact: Write a web shell into the web root → RCE → lateral movement to backup repository servers via stored VSPC credentials.

Exploitation Scenarios

Preconditions for this scenario (note: from the data provided, the vulnerability is unauthenticated):

• An attacker must be able to reach the VSPC management web interface (port 443) over the network.
• No credentials or session tokens are required.

Attack Chain:

Step 1: Reconnaissance and Target Identification The attacker scans for exposed management consoles using the http.title:"Veeam Service Provider Console" Shodan dork or by probing corporate IP ranges on ports 443/80. They confirm the target by requesting https://<victim>/ and observing the VSPC login page. Fingerprinting the exact patch level is done by checking the /api/version endpoint (unaudited) or inspecting the page's JavaScript bundle.

Step 2: Trigger and Weaponization The attacker constructs an HTTPS request to the vulnerable file-write endpoint. A typical vulnerable request looks like this:

PUT /api/file/upload?filename=../../../../../../Windows/Temp/evil.asp HTTP/1.1
Host: victim-vspc.example.com
Content-Type: application/octet-stream
Content-Length: <payload-size>

<ASP web shell payload>

The filename parameter is URL-encoded traversal: ..%2f..%2f..%2f..%2f..%2fwindows%2ftemp%2fevilshell.aspx.

Step 3: Payload Execution

• Option A (web shell): The attacker writes an ASP/ASPX web shell into the VSPC web root directory (e.g., C:\Program Files\Veeam\VSPC\Web\wwwroot\). They then browse to https://<victim>/shell.aspx and execute arbitrary commands as SYSTEM.
• Option B (binary planting): The attacker drops a malicious executable into a startup directory (C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\) or overwrites a scheduled task payload, achieving persistence and RCE upon next reboot.
• Option C (credential theft): The attacker writes a DLL into the VSPC installation directory to be loaded by the service, hooking into the backup credential store to exfiltrate tenant credentials.

Step 4: Post-Exploitation Impact Once RCE is achieved:

• The attacker reads C:\ProgramData\Veeam\VSPC\Sessions.xml or the SQL database (usually local SQL Express) to obtain plaintext or reversible credentials for all connected tenant backup agents and repositories.
• Using VSPC's built-in deployment tools, the attacker pushes a malicious backup agent update to all managed tenants, creating a supply-chain compromise across the MSP's entire client base.
• The attacker deletes backups or ransomware-encrypts them, eliminating restore points.

Impact Assessment

CVSS Considerations: While the official CVSS score is listed as N/A, using the CVSS v3.1 criteria with the attack vector (Network), attack complexity (Low), privileges required (None), user interaction (None), and considering the SYSTEM-level impact: This aligns with a Critical severity (9.0–10.0 range). The CWE-22 classification and the public PoC availability reinforce this assessment.

Business Impact:

• Confidentiality: Total breach — access to all backup data, tenant credentials, and encryption keys.
• Integrity: Complete compromise — attacker can modify backups, inject malicious code into the backup pipeline, and alter VSPC configurations.
• Availability: High — an attacker can destroy all backups, preventing disaster recovery for the MSP and all of its clients.

Blast Radius:

• Veeam Service Provider Console is deployed by Managed Service Providers (MSPs) to centrally manage backup infrastructure for dozens to hundreds of client organizations.
• A single VSPC management server breach cascades into every tenant's backup agents and repositories.
• The affected systems include: the management server itself, connected backup servers (Veeam Backup & Replication), and all endpoints/agents reporting to the console.

Exploitation Context:

• EPSS score of 0.00376 (30.3rd percentile) indicates a real, measurable probability of exploitation in the wild.
• Public PoC existence raises the threat level; although no Nuclei template or exploit code is tracked, the technique description is sufficient for skilled attackers to reproduce the flaw.

Detection Guidance

Sigma Rule

title: Veeam Service Provider Console - Arbitrary File Write via Path Traversal
id: 4f8a2c10-9e8d-4a5f-b6c1-3d7e8a9b0c1d
status: experimental
description: Detects HTTP requests attempting path traversal in VSPC file upload endpoints.
references:
    - CVE-2026-58072
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - 'filename=..%2f'
            - 'filename=../'
            - 'filename=..\\'
            - '..%5c'
            - '..%252f'
        cs-method:
            - 'PUT'
            - 'POST'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative file management tools
level: high
tags:
    - attack.t1190
    - cve.2026.58072

YARA Rule

rule Veeam_VSPC_ArbitraryFileWrite_Exploit
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP request payloads containing path traversal strings targeting VSPC file upload endpoints"
        date = "2026-01-15"
        cve = "CVE-2026-58072"
        severity = "critical"

    strings:
        $s1 = "filename=../../" ascii nocase
        $s2 = "filename=..%2f" ascii nocase
        $s3 = "filename=..\\" ascii nocase
        $s4 = "/api/file/upload" ascii nocase
        $s5 = "%2e%2e%2f" ascii nocase
        $s6 = "..%252f" ascii nocase

    condition:
        any of ($s1, $s2, $s3, $s5, $s6) and $s4
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-58072 - Veeam SP Console Path Traversal File Write"; flow:to_server,established; content:"PUT"; http_method; content:"|2e 2e 2f|"; http_uri; content:"/api/file/upload"; http_uri; pcre:"/filename=.*(?:\.\.\/|\.\.%2f|\.\.\\\\)/iU"; sid:20265801; rev:1; metadata:attack_target_web_server, cve2026_58072, tag_path_traversal;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network_traffic" and event.outcome == "success"
    and destination.port == 443 and network.protocol == "tls" ]
  [ http where event.category == "http" and http.request.method == "PUT"
    and url.path == "/api/file/upload"
    and (
      wildcard(url.query, "*filename=..%2f*") or
      wildcard(url.query, "*filename=../*") or
      wildcard(url.query, "*filename=..\\*") or
      wildcard(url.query, "*..%252f*")
    )
  ]

Note: Requires network-level TLS decryption or capture of HTTP traffic before encryption.

Splunk SPL Query

index=proxy OR index=weblogic
| where (method="PUT" OR method="POST")
    AND match(uri_path, ".*/api/file/upload.*")
    AND (match(form_data, "(?i)filename=.*(\.\.\/|\.\.%2f|\.\.\\\\)") 
         OR match(query, "(?i)filename=.*(\.\.\/|\.\.%2f|\.\.\\\\)"))
| eval attack_signal = "CVE-2026-58072 Path Traversal"
| table _time, src_ip, dest_ip, uri_path, method, form_data

Wazuh OSSEC Rule

<group name="veeam,vspc,cve-2026-58072,">
  <rule id="770230" level="15">
    <decoded_alert>
      <field name="url">/api/file/upload</field>
    </decoded_alert>
    <field name="parameters">
      <regex>\.\.(/|%2f|\\\\)</regex>
    </field>
    <description>CVE-2026-58072: Veeam SP Console Path Traversal File Write attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked vendor source. The NVD description does not reference a specific "fixed in version," and the vendor advisory status is unconfirmed.

1. Immediate Mitigations (compensating controls):

• Restrict network access to the VSPC management interface. Block inbound access from the internet; allow only from trusted internal IPs or a VPN gateway via firewall rules (e.g., netsh advfirewall firewall add rule name="VSPC Block" dir=in action=block remoteip=any localport=443 protocol=TCP if applicable).
• Place the VSPC management server behind a reverse proxy with Web Application Firewall (WAF) rules blocking traversal sequences (%2e%2e, ..\, ../) at the proxy level.
• Harden the file system: remove write permissions for the VSPC service account from all directories except the required application paths. Use Windows software restriction policies to block writes to System32, inetpub, and startup folders.
• Implement application-level input validation via a WAF rule that blocks any request to /api/file/upload with filename parameters containing traversal characters.

2. Patch/Upgrade Steps:

• Since no patch exists, monitor vendor security advisories (Veeam security advisory page) continuously. The "Patch Sources: []" data indicates no tracked patch release.
• When a patch becomes available, upgrade the Veeam Service Provider Console to the fixed version (expected to be the next cumulative update after the disclosure). Ensure the upgrade is tested in a staging environment first.
• If you cannot wait, consider migrating to the Veeam Backup & Replication console (non-SPC) if the multi-tenant capability is not strictly required.

3. Long-Term Hardening:

• Run the VSPC service under a dedicated least-privilege service account instead of SYSTEM.
• Deploy Microsoft Defender for Endpoint on the management server with attack surface reduction rules (e.g., block credential theft from Windows local security authority subsystem, block executable files from running unless they meet prevalence criteria).
• Enable comprehensive audit logging on the server (File System auditing on directories, Windows Defender Firewall logs, IIS W3C logs with extended fields).
• Implement a network segmentation strategy where VSPC management servers reside in a dedicated administrative VLAN, isolated from tenant backup repositories.
• Regularly review Veeam's security bulletin page and RSS feeds for updates on this CVE.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58072
2. Veeam Security Advisory Hub: https://www.veeam.com/kb/security-advisories
3. CWE-22 Specification (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
4. MITRE ATT&CK Technique T1190 – Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Exploit-DB / Research Notes (Public PoC Reference): https://www.exploit-db.com/ — search for "Veeam VSPC 2026"

Threat Actor Campaigns: no CISA KEV listing (CISA KEV: NO) and no confirmed exploit-in-the-wild campaigns as of this report. However, the public PoC publication raises the likelihood of imminent weaponization.