CVE-2024-29212

9.9 criticalEPSS 1.6%

Critical (9.9) in veeam veeam service provider console. EPSS 1.6% chance of exploitation in the next 30 days.

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

Severity

CVSS 3.0

9.9 critical

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2024-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

veeam:veeam_service_provider_console

References

https://www.veeam.com/kb4575
https://www.veeam.com/kb4575

Check your stack JSON