How severe is CVE-2026-58067?

CVE-2026-58067 has a CVSS 4.0 base score of 8.7, rated high severity.

Is CVE-2026-58067 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-58067?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-58067 published?

CVE-2026-58067 was published on 2026-08-04 and last updated on 2026-09-03.

CVE-2026-58067

CVE-2026-58067 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-789.

Key facts

Severity: High (CVSS 4.0 base score 8.7)
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-789
Published: 2026-08-04
Last modified: 2026-09-03

Description

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.

Frequently asked questions

What is CVE-2026-58067?: A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.
How severe is CVE-2026-58067?: CVE-2026-58067 has a CVSS 4.0 base score of 8.7, rated high severity.
Is CVE-2026-58067 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-58067?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-58067 published?: CVE-2026-58067 was published on 2026-08-04 and last updated on 2026-09-03.

References

https://www.veeam.com/kb4893

Other CWE-789 vulnerabilities

CVE-2026-82435 — Critical (CVSS 9.8): Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the…
CVE-2026-77410 — High (CVSS 8.9): RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the…
CVE-2021-34869 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
CVE-2021-34868 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
CVE-2026-63574 — High (CVSS 8.7): Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers…
CVE-2026-103603 — High (CVSS 8.7): Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in…

Browse all CWE-789 vulnerabilities →