Veeam Service Provider Console is vulnerable to a command injection flaw that permits remote execution of arbitrary system commands. This flaw, classified as CWE‑233, effectively removes the integrity and confidentiality of the affected system, allowing a malicious actor to take full control.

The vulnerability affects Veeam Service Provider Console. No specific version constraints are listed, so all currently deployed installations may be affected until a vendor patch is released.

The CVSS score of 9.4 denotes critical severity. No EPSS score is currently available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of data does not reduce the risk of exploitation. An attacker is likely to take advantage of the command injection remotely over the network, possibly using default or weak credentials or simply through an open management port.