CVE-2024-39715: Veeam Service Provider Console

High severity, CVSS 8.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.

Affected products

• Veeam Service Provider Console: from 8, up to and including 8.0.0.19552
• Veeam Veeam Service Provider Console: from 8, up to and including 8

Published 2024-09-07. Last modified 2026-06-17.