CVE-2026-58072Patch

🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes. Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE. HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869. Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution. See what needs patching: https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html

🚨Critical - Veeam Service Provider Console Unauthenticated Agent Impersonation and Credential Theft (CVE-2026-58073) A flaw in Veeam Service Provider Console (before 9.3) lets an unauthenticated attacker impersonate a managed agent and obtain that agent's credentials. VSPC is the multi-tenant console MSPs and cloud providers use to manage Veeam backups across many customers, so stealing a trusted agent's credentials is a route into managed backup environments. It's unauthenticated (though high attack complexity) and scope-changing with full CIA impact. It pairs with the authenticated file-write RCE CVE-2026-58072 in the same release. CVSS 9.5. 👉Upgrade Veeam Service Provider Console to 9.3 per Veeam KB4893 (also fixes CVE-2026-58072), and restrict access to the console.

Two critical vulnerabilities in Veeam Service Provider Console — CVE-2026-58073 and CVE-2026-58072 — can be chained by an unauthenticated attacker to achieve remote code execution on the management... https://cvetodo.com/news/critical-veeam-service-provider-console-flaws-allow-unauthenticated-rce-researcher-details-full-expl #Veeam #RCE #CriticalVulnerability #CVE #InfoSec https://t.co/j7y5BreQnX

『CVE-2026-58072 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remote code execution.』