CVE-2026-58067

HighCVSS 8.7/10Last modified Oct 24, 2026

Description

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 4, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-580686.8This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.CVE-2026-580698.3This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provideCVE-2026-58077.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generatiCVE-2026-580706.8A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access toCVE-2026-580718.2A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal AdministCVE-2026-580729.0A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execuCVE-2026-580739.5A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent'sCVE-2026-580748.6A vulnerability allowing a high-privileged user to execute arbitrary code on the server.CVE-2026-580758.7A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privilCVE-2026-580768.8Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blCVE-2026-580778.7Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unautCVE-2026-580788.7Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder
CVE-2026-58067: High severity, CVSS 8.7 | Vulnix