Critical RCE flaw in Veeam Service Provider Console fixed in 9.2.1
Veeam disclosed a critical remote‑code‑execution vulnerability (CVSS 9.4) in Service Provider Console that could be triggered through enabled alarm script execution. The flaw, reported via HackerOne, is mitigated by disabling the script execution flag or upgrading to version 9.2.1 (build 33875). Administrators are urged to patch immediately.