This vulnerability in Veeam Service Provider Console enables an unauthenticated attacker to bypass authentication mechanisms by using an alternate path or channel, thereby impersonating a managed agent. This impersonation allows the attacker to obtain the credentials of the targeted agent. The vulnerability is identified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a CVSS 4.0 score of 9.5, reflecting critical impact. No official patch or remediation level has been disclosed, and no affected versions are specified in the available data.

An unauthenticated attacker can impersonate a managed agent within the Veeam Service Provider Console, gaining access to that agent's credentials. This could lead to unauthorized access and potential compromise of managed systems or data. The critical CVSS score reflects the high potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently documented, users should monitor Veeam's advisories closely for updates. Avoid exposing the Service Provider Console to untrusted networks until a fix is available.