This vulnerability in Veeam Service Provider Console arises from missing authentication controls on a critical function, enabling an unauthenticated attacker to gain privileged access to the proxied appliance API asPortal Administrator during a short time window immediately following the start of an administrator session. The CVSS 4.0 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is provided, and the affected versions are not specified.

An unauthenticated attacker can gain administrative-level access to the proxied appliance API during a limited time window, potentially compromising confidentiality and control of the appliance. This could lead to unauthorized access and manipulation of sensitive data or system functions within the Veeam Service Provider Console environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Service Provider Console and monitor for unusual activity during administrator session initiation periods.