Veeam CVE-2024-29212 is a critical remote code execution flaw in the Veeam Service Provider Console (VSPC). It comes from unsafe deserialization in the communication between the management agent and its components. The National Vulnerability Database lists a CVSS v3.0 score of 9.9. Versions 7 and 8 are affected, and patched builds are available.
What is the Veeam CVE-2024-29212 vulnerability?
Veeam, a leading provider of backup and data protection solutions, has released a security advisory concerning a critical remote code execution (RCE) vulnerability in its Service Provider Console (VSPC). Identified as CVE-2024-29212, this vulnerability poses significant risks as it allows attackers to potentially infiltrate VSPC servers and access sensitive backup data.
– The vulnerability was found within the Veeam Service Provider Console (VSPC), which is utilized for overseeing data protection operations across both physical and virtual environments.
– Rated with a critical severity score of 9.9 on the CVSS scale, CVE-2024-29212‘s danger lies primarily in its capacity to enable remote code execution on the servers running VSPC.
– The security issue originates from an unsafe deserialization practice during the communication between the management agent and its components, which, if exploited, could allow an attacker to run malicious code on the VSPC server, potentially leading to data breaches or disruptions in data protection services.
How did Veeam fix it?
Veeam responded promptly upon discovering the vulnerability by rolling out fixes in the latest builds of the Veeam Service Provider Console:
– Veeam Service Provider Console v7.0.0.19551
– Veeam Service Provider Console v8.0.0.19552
What should service providers do?
Veeam has strongly recommended that all service providers using versions 7 and 8 of the console apply these cumulative patches immediately. Furthermore, those using older, unsupported versions are advised to upgrade to a current supported release to secure the enhanced security features and protect against potential threats.
Newer Veeam updates of 27 October 2026 cover Backup and Replication and Veeam ONE, described in our post on the Veeam Backup and Replication patch.