Auth bypass in Veeam Service Provider Console

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.

Vulnerability class: Broken Authentication

EPSS: 0.004 (29.8th percentile) — read the EPSS interpretation.