CVE-2024-39714: Veeam Service Provider Console

Critical severity, CVSS 9.9. EPSS: 1.2% chance of exploitation in the next 30 days.

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.

Affected products

• Veeam Service Provider Console: from 8, up to and including 8.0.0.19552
• Veeam Veeam Service Provider Console: from 8, up to and including 8

Published 2024-09-07. Last modified 2026-06-17.