Memory Exhaustion DoS in Veeam Service Provider Console

Executive Summary

CVE-2026-58067 is a high-severity vulnerability in Veeam Service Provider Console versions 9.2.1.33875 and earlier. It allows an unauthenticated attacker to exhaust host memory, causing a denial of service (DoS) condition by consuming excessive system resources.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory consumption or service crashes in Veeam Service Provider Console. Check logs for repeated failed connection attempts or resource exhaustion alerts. Use system monitoring tools like top, htop, or Windows Resource Monitor to track memory usage by the Veeam service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to disrupt services by consuming too much memory, leading to system crashes or slowdowns. It affects Veeam Service Provider Console versions before 9.3.0.35057.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions through denial of service. GDPR requires maintaining data availability, and HIPAA mandates reliable access to protected health information. A DoS condition may violate these requirements by preventing authorized access to systems handling sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Veeam Service Provider Console to version 9.3.0.35057 or later immediately. If upgrading is not possible, restrict network access to the console and monitor for suspicious activity. Apply network segmentation to limit exposure.

Useful 0 Not Useful 0