Vulnerability in Veeam Service Provider Console
CVE-2026-64635
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.
EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Veeam Service Provider Console — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-64635?
- CVE-2026-64635 is a medium-severity vulnerability in Veeam Service Provider Console, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 5.3/10. Published 2026-07-30.
- How severe is CVE-2026-64635?
- Medium severity. CVSS v3 base score is 5.3 out of 10.