This vulnerability in Veeam Service Provider Console involves missing authentication controls that permit an unauthenticated attacker to gain access to the proxied appliance API asPortal Administrator shortly after an administrator session begins. The flaw is categorized under CWE-306 (Missing Authentication for Critical Function). The CVSS 4.0 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild. No affected versions or patch information are provided in the available data.

An unauthenticated attacker can access the proxied appliance API with administrative privileges during a short time window after an administrator logs in, potentially allowing unauthorized control or manipulation of the appliance. This could lead to significant security breaches given the high privileges involved.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for updates from Veeam and consider limiting exposure of the Service Provider Console to untrusted networks if possible.