CVE-2024-38650: Veeam Service Provider Console

Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days.

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

Affected products

• Veeam Service Provider Console: from 8, up to and including 8.0.0.19552
• Veeam Veeam Service Provider Console: from 8, up to and including 8

Published 2024-09-07. Last modified 2026-06-17.