PT-2026-44176 · Veeam · Veeam Service Provider Console

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-32998

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console versions prior to 9.2.1.33875

Description A critical issue allows for remote code execution. The problem is related to script execution within alarms.

Recommendations Upgrade to Veeam Service Provider Console 9.2.1.33875. As a temporary mitigation, disable AlarmManagement ScriptExecutionEnabled and restart the Veeam Management Portal Service.

Fix

RCE

Weakness Enumeration

CWE-233

Related Identifiers

CVE-2026-32998

Affected Products

Veeam Service Provider Console

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32998 · Security Note
• https://twitter.com/UpwindMDR/status/2059941878385004774 · Twitter Post
• https://twitter.com/ADKCyber/status/2060112315450544403 · Twitter Post
• https://veeam.com/kb4853 · Note