Vulnerability · Published Jul 30, 2026 · Assigned by hackerone

CVE-2026-64635

Medium 5.3

In plain English

A medium-severity security flaw in Service Provider Console from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.

Affected products (as reported)

Vendor	Product	Versions
Veeam	Service Provider Console	0 – through 9.2

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://www.veeam.com/kb4853