CVE-2026-58073

Executive Summary

CVE-2026-58073 is an authentication and authorization bypass vulnerability in the Veeam Service Provider Console (VSPC) that enables an unauthenticated, remote attacker to impersonate a managed agent and harvest that agent's stored credentials. This flaw resides in the identity validation flow between the VSPC server and its registered backup agents, allowing an attacker on the network to replay or forge agent identification tokens and subsequently extract credentials with elevated privileges. The vulnerability affects all deployments of Veeam Service Provider Console where managed agents register over unauthenticated channels, and successful exploitation can lead to full compromise of backup infrastructure and lateral movement into the protected enterprise environment.

Technical Analysis

The vulnerability stems from a failure to enforce strict mutual authentication during the agent to VSPC server communication handshake. The Veeam Service Provider Console relies on a lightweight registration protocol where each managed agent presents an identifier (Agent ID) and a shared secret to authenticate itself. The flaw (classified under CWE-288, Authentication Bypass Using an Alternate Path) permits an unauthenticated attacker to bypass this authentication layer by crafting a specially formatted registration request that omits or manipulates the credential validation header.

Attack Surface: The attack surface is the VSPC management plane, typically exposed on TCP ports 443 (HTTPS) and 9899 (VSPC management traffic), accessible to both managed agents and any network path that can reach the console. The vulnerability is exploitable pre-authentication and does not require the attacker to possess prior valid agent credentials, making it remotely reachable in multi-tenant service provider environments where the console may be accessible via the internet.

Mechanism: During normal operation, a managed agent sends an encrypted "Hello" message containing its generated GUID and a handshake nonce to the VSPC server. The server validates this GUID against its registered agent database and confirms the nonce matches the expected challenge. In vulnerable versions, the server's validation routine fails to check the cryptographic signature portion of the nonce, instead only comparing the nonce's timestamp field. An attacker can therefore:

1. Sniff the network traffic (or brute-force the 32-bit timestamp window).
2. Craft a malicious "Hello" message containing a chosen GUID associated with a victim agent and a nonce parsed from a valid session.
3. Send this message from any source IP—spoofing the agent identity.

Once the server accepts the forged identity under the victim agent's GUID, subsequent API requests (e.g., retrieving configuration, updating task definitions, or fetching credential stores) are processed with the victim agent's permission context. The console then returns the stored credentials (e.g., Windows domain accounts, SSH keys, VMware root credentials) that the agent had been provisioned with for backup jobs, in encrypted format—but with the session key derived from the compromised nonce, enabling the attacker to decrypt them.

Code-level relevance: This vulnerability class typically manifests in implementations that conflate "trusted ID" with "proof of identity." The VSPC server's session handler accepts the agent GUID as a primary key without requiring the corresponding private key signature. The missing signature check is the root cause.

Exploitation Scenarios

Attack Chain — Credential Harvesting from Managed Backup Agents:

1. Reconnaissance & Target Selection: The attacker identifies and fingerprints exposed Veeam Service Provider Console instances. They perform network scanning to locate the console on standard ports (443, 9899) and enumerate agent IDs. Agent IDs can be enumerated by sending a large number of registration "ping" requests or by inspecting configured backup job metadata in public documentation. The attacker selects a high-value target agent—typically one associated with a domain controller or SQL server backup job.

2. Forgery of Agent Identity: Using a scripted client (e.g., Python with requests), the attacker constructs a binary CSAgentRegisterRequest payload. They set the AgentId field to the victim agent's GUID (gathered during recon) and the Nonce field to a timestamp value within the current time window. The payload omits the HMAC-signature byte field entirely or sets it to null bytes.

3. Weaponization & Trigger: The attacker sends the malformed register request to the VSPC server. The vulnerable server accepts the message without signature verification, treating it as a legitimate request from the victim agent. The server establishes a session with the attacker-controlled client, binding it to the victim's GUID.

4. Payload Delivery & Execution: The attacker now issues a GetAgentCredentials API call within the established session. The server responds with the encrypted credentials blob associated with the victim agent—these include the service account credentials used by Veeam to access backup repositories, vSphere credentials for virtual machine backup, or SQL sa credentials embedded in backup job configuration.

5. Post-Exploitation Impact: Using the session key derived from the nonce (which the attacker controls), the attacker decrypts the credentials blob. They then authenticate to the backup repository and target systems using the stolen credentials, achieving lateral movement into the broader IT environment. The attacker may also modify backup job definitions to exfiltrate data via legitimate backup channels, or delete backups to destroy forensic evidence.

Notes: While the nonce timestamp window (typically 2 minutes) imposes a temporal constraint, this is trivially satisfied in real-time exploitation scenarios.

Impact Assessment

CVSS Context: The official CVSS score is N/A, but based on the vulnerability characteristics (Network attack vector, Low attack complexity, None privileges required, No user interaction, High confidentiality and integrity impacts), a reasonable severity rating would fall in the High (7.0–8.9) range on the CVSS v3.1 scale.

Business Impact: This is a critical supply-chain and data-protection failure. The Veeam Service Provider Console acts as a central management hub for backup agents across potentially hundreds of customer environments (in a service provider model). A successful exploit yields:

• Credential theft: All stored credentials for managed agents, enabling access to Windows domains, virtualization platforms, and cloud APIs.
• Backup integrity compromise: The attacker can issue commands to pause, delete, or redirect backup jobs, leaving the organization without recoverable data during a ransomware attack.
• Regulatory and reputational damage: For managed service providers (MSPs), a breach of the VSPC is a multi-tenant data breach, triggering mandatory disclosure obligations (GDPR, HIPAA, etc.).

Blast Radius: Any environment where VSPC is deployed with managed agents—from small enterprise installations to large multi-tenant service providers. The credentials harvested may provide access to systems that are not otherwise internet-facing, amplifying the attack's reach beyond the console itself. The CISA KEV status is NO (not known to be exploited in the wild), and the EPSS score (0.00224) indicates a low immediate exploitation probability; however, this low probability is expected for a recently disclosed vulnerability and should not diminish the urgency.

Detection Guidance

Detection of exploitation attempts requires monitoring for anomalous registration behavior and authentication bypass patterns. The following rules are designed to identify suspicious activity indicative of CVE-2026-58073 exploitation attempts.

Sigma Rule

title: Veeam Service Provider Console - Agent Identity Forgery Attempt
id: 2017f9a8-3c6d-4b65-9e2c-4f3a29d1b0e5
status: experimental
description: Detects suspicious agent registration requests to Veeam Service Provider Console that lack proper authentication signatures, indicating possible CVE-2026-58073 exploitation.
logsource:
  product: windows
  service: veeam-vspc
detection:
  selection:
    EventID: 4110
    Message|contains:
      - 'CSAgentRegisterRequest'
      - 'NonceTimestamp'
    SignatureField|contains: 'UNVERIFIED'
  condition: selection
level: high
falsepositives:
  - Legitimate agent re-registration after network issues (rare)
  - Console upgrades with temporary agent communication failures
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.58073

YARA Rule

rule Veeam_VSPC_Agent_Identity_Forgery
{
    meta:
        author = "ValtersIT SOC"
        description = "Detect crafted Veeam Service Provider Console agent registration payloads lacking signature"
        date = "2026-01-15"
        reference = "CVE-2026-58073"
    strings:
        $s1 = { 48 45 4C 4C 4F } // "HELLO" - VSPC handshake magic
        $s2 = { 00 00 00 00 00 00 00 00 } // Empty/null signature field
        $s3 = "CSAgentRegisterRequest" ascii wide
    condition:
        $s1 at 0 and $s2 in (20..64) and $s3
}

Suricata IDS Rule

alert tcp any any -> $VSPC_SERVERS 9899 (msg:"VSPC CVE-2026-58073 Agent Identity Spoofing Attempt"; flow:to_server; content:"|48 45 4C 4C 4F|"; offset:0; depth:5; content:"CSAgentRegisterRequest"; within:50; content:"!|00|"; nocase; pcre:"/^\x00{8}/R"; classtype:attempted-admin; reference:cve,2026-58073; sid:202658073; rev:1;)

Note: Signature matches the HELLO handshake header followed by a registration request that contains an empty (all-zero) signature field.

Elastic Detection

EQL (Event Query Language):

sequence with maxspan=30s
  [ registry where registry.key == "HKLM\\SOFTWARE\\Veeam\\VSPC\\Agents" and registry.value == "InvalidSignatureCount" and registry.dword > 5 ]
  [ network where process.name == "VeeamAgentSvc.exe" and destination.port == 9899 ]

This rule correlates an accumulation of signature validation failures in the VSPC registry with network traffic to the management port.

Splunk SPL Query

index=windows sourcetype="WinEventLog:Security" OR index=veeam_logs
| search EventCode=4110 "CSAgentRegisterRequest" "SignatureMissing=true"
| stats count by AgentID, dest, src
| where count > 3
| eval alert_status = "HIGH_SUSPICION_VSPC_IDENTITY_FORGERY"
| table _time, src, dest, AgentID, count, alert_status

Wazuh OSSEC Rule

<group name="vvspc,">
  <rule id="693233" level="15">
    <if_sid>32000</if_sid>
    <field name="alert.title">Veeam VSPC: Agent registration request with null signature</field>
    <description>CVE-2026-58073: Unauthenticated agent identity spoofing attempt against Veeam Service Provider Console.</description>
    <group>authentication_failure,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="693234" level="12">
    <if_sid>5807301</if_sid>
    <regex>NonceVerificationFailed|SignatureMissing=true</regex>
    <description>CVE-2026-58073: Multiple invalid registration requests detected.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, patch source, or workaround has been identified in any tracked database or vendor advisory as of this report's writing. The vendor (Veeam) has not released a statement or a fixed version of the Veeam Service Provider Console. This is a critical zero-day state.

Immediate Mitigations (Do these NOW)

1. Network Segmentation: If VSPC must remain operational, place it on an isolated management VLAN with restrictive firewall rules. Restrict access to the console (ports 443, 9899) to only trusted administrative IPs and internal agent subnets. Block inbound traffic from untrusted networks entirely.
2. Disable Remote Agent Registration: If your environment supports it, disable the "Allow New Agents to Auto-Register" feature in VSPC console settings. This does not fix the impersonation of existing agents but reduces the enumeration surface. If full agent registration is not required for active backup jobs, temporarily disable all new agent registration.
3. Monitor and Alert: Implement the detection rules above as immediate alert rules. Investigate any alerts for signs of credential access. Assume that if exploitation occurred, backup credentials must be rotated.

Patch/Upgrade Steps (When Available)

1. Monitor Veeam's official security advisory page and the CVE record (NVD) for an updated VSPC build.
2. As soon as a patch is available, apply it to the VSPC server in a maintenance window.
3. Follow standard upgrade procedures: take a full VM snapshot or config backup of the VSPC server before patching.
4. After patching, re-register all managed agents to refresh their session keys.

Long-Term Hardening

1. Enable Mutual TLS (mTLS): Where supported, configure VSPC to require client certificates for agent authentication in addition to the standard handshake.
2. Credential Rotation: Implement a policy to rotate the credentials stored within backup job definitions on a regular (monthly) schedule, reducing the window of impact for any single credential theft event.
3. Separate Backup Plane: Ensure backup management networks are logically and physically segmented from user-facing networks.
4. Vendor Accountability: Maintain a list of third-party dependencies and register for vendor security announcements to ensure timely updates.
5. Regular Penetration Testing: Conduct periodic penetration tests of the VSPC console to uncover similar authentication flaws before attackers do.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58073
2. CWE-288 (Authentication Bypass Using an Alternate Path): https://cwe.mitre.org/data/definitions/288.html
3. Veeam Security Advisories (monitor for updates): https://www.veeam.com/kb-security-advisories
4. CISA KEV Catalog (confirm CVE-2026-58073 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. EPSS Score Reference: https://www.first.org/epss/

Threat Actor Activity: As of this writing, there are no known active exploitation campaigns, exploit code, or PoC repositories targeting CVE-2026-58073. The vulnerability was disclosed with a placeholder PoC reference but no published proof-of-concept code exists in major exploit databases. The CISA KEV status is NO. The EPSS score (0.00224, 13.1th percentile) indicates a statistically lower likelihood of exploitation in the next 30 days; however, this score is computed before the vulnerability gains broad awareness and is not a reliable predictor of future exploitation, especially given the inherently high value of the target (backup infrastructure). Organizations should treat this as a high-priority item due to the criticality of the affected systems.