What is CVE-2026-64635?

CVE-2026-64635 is a medium-severity vulnerability in Veeam Service Provider Console, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 5.3/10. Published 2026-07-30.

How severe is CVE-2026-64635?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Veeam Service Provider Console

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the…

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Veeam Service Provider Console — versions 0

Weakness classification (CWE)

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

References

support@hackerone.com

Frequently asked questions

What is CVE-2026-64635?: CVE-2026-64635 is a medium-severity vulnerability in Veeam Service Provider Console, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 5.3/10. Published 2026-07-30.
How severe is CVE-2026-64635?: Medium severity. CVSS v3 base score is 5.3 out of 10.