# CVE-2026-32998: Veeam Service Provider Console remote code execution in alarm management

Source: https://junglewise.ai/threats/cve-2026-32998-veeam-service-provider-console-remote-code-execution-in-alarm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-32998 · Severity: info · CVSS 9.4 · Published 2026-05-28

A vulnerability in the Veeam Service Provider Console, a platform used by managed service providers to manage backup and recovery operations, could allow an attacker to execute malicious commands remotely. If exploited, an attacker could gain full control over the management server, potentially compromising customer backup data and disrupting service operations. The issue is specifically related to how the system handles automated scripts within its alarm notification system.

Technologies: [Veeam Service Provider Console](https://junglewise.ai/threats/technologies/service-provider-console). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-32998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32998 being exploited in the wild.

**How severe is CVE-2026-32998?** Informational severity, with a CVSS score of 9.4, published 28 May 2026.

**Which products and versions are affected?** Veeam Service Provider Console 9.2.0.33215 and all earlier version 9 builds.

**Is there a fix for CVE-2026-32998?** A patch was published on 2026-05-27: Vulnerability resolved in build 9.2.1.33875 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32998 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32998?** Check whether you run Veeam Service Provider Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution vulnerability exists in Veeam Service Provider Console due to improper handling of parameters (CWE-233) within the alarm management component. An attacker with low-privileged network access can exploit this flaw to execute arbitrary code on the server. The vulnerability is specifically tied to the 'AlarmManagement_ScriptExecutionEnabled' feature, which is disabled by default in version 9.2 but may be active if legacy alarms with script actions exist. Attackers can achieve full system compromise (High Confidentiality, Integrity, and Availability impact). The issue is resolved in version 9.2.1.33875, and a manual mitigation is available by disabling script execution in the configuration.overrides.json file.

## Affected products

- Veeam Service Provider Console 9.2.0.33215 and all earlier version 9 builds

## Timeline

- 2026-05-27: patched: Vulnerability resolved in build 9.2.1.33875
- 2026-05-28: disclosed: Initial NVD publication and advisory release

## References

- [https://www.veeam.com/kb4853](https://www.veeam.com/kb4853)

## Related threats

- [Veeam Service Provider Console agent impersonation](https://junglewise.ai/threats/cve-2026-58073-veeam-service-provider-console-agent-impersonation)
- [Veeam Service Provider Console arbitrary file write and RCE](https://junglewise.ai/threats/cve-2026-58072-veeam-service-provider-console-arbitrary-file-write-and-rce)
- [Veeam Service Provider Console unauthenticated admin API access](https://junglewise.ai/threats/cve-2026-58071-veeam-service-provider-console-unauthenticated-admin-api-access)
- [Veeam Service Provider Console memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-58067-veeam-service-provider-console-memory-exhaustion-denial-of)
- [Veeam Service Provider Console account takeover via password reset hijacking](https://junglewise.ai/threats/cve-2026-64635-veeam-service-provider-console-account-takeover-via-password)