NTLM hash disclosure and arbitrary file deletion

Arbitrary file deletion in Veeam Service Provider Console 8.1 and earlier allows remote authenticated users to delete VSPC server files. An authorized VSPC management agent can trigger the server to disclose the service account's NTLM hash and remove attacker-chosen files, but Veeam has not published the responsible endpoint, handler, or file-path validation failure. Exploitation requires a management agent already authorized on the VSPC server; consequences are bounded to credential-hash disclosure and deletion of files accessible to the server service.