Is CVE-2026-64635 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64635 being exploited in the wild.

How severe is CVE-2026-64635?

Medium severity, with a CVSS score of 5.3, published 30 July 2026.

Which products and versions are affected?

Veeam Service Provider Console 9.2.1.33875 and earlier.

Is there a fix for CVE-2026-64635?

A patch was published on 2026-07-28: KB updated with fix information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64635 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-64635?

Check whether you run Veeam Service Provider Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64635: Veeam Service Provider Console account takeover via password reset hijacking

CVE-2026-64635 · Severity: medium · CVSS 5.3 · Published 2026-07-30

A vulnerability in the Veeam Service Provider Console, a tool used by service providers to manage backup services, could allow an attacker to take over user accounts. By manipulating the password reset process, an attacker can trick the system into sending a reset link that directs the user's secret credentials to the attacker instead of the legitimate site. If a user clicks this malicious link in their email, the attacker can gain full access to their account.

Technologies: Veeam Service Provider Console. Vendors: Veeam.

Quick answers

Is CVE-2026-64635 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64635 being exploited in the wild.
How severe is CVE-2026-64635?: Medium severity, with a CVSS score of 5.3, published 30 July 2026.
Which products and versions are affected?: Veeam Service Provider Console 9.2.1.33875 and earlier.
Is there a fix for CVE-2026-64635?: A patch was published on 2026-07-28: KB updated with fix information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64635 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-64635?: Check whether you run Veeam Service Provider Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Weak Password Recovery Mechanism (CWE-640) exists in the Veeam Service Provider Console due to improper validation of the 'returnUrl' parameter. An unauthenticated remote attacker can craft a password reset request that specifies an attacker-controlled domain in the 'returnUrl' field. When the targeted user receives the legitimate password reset email and clicks the link, the embedded reset token is transmitted to the attacker's server via the Referer header or direct redirection. This allows the attacker to capture the token and complete the password reset process to hijack the account. The vulnerability is resolved in version 9.2.1.33875.

Affected products

Veeam Service Provider Console 9.2.1.33875 and earlier

Timeline

2026-05-27: disclosed: Initial KB publication
2026-07-28: patched: KB updated with fix information
2026-07-30: advisory: NVD publication date

References

https://www.veeam.com/kb4853

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.