# CVE-2026-64635: Veeam Service Provider Console account takeover via password reset hijacking

Source: https://junglewise.ai/threats/cve-2026-64635-veeam-service-provider-console-account-takeover-via-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-64635 · Severity: medium · CVSS 5.3 · Published 2026-07-30

A vulnerability in the Veeam Service Provider Console, a tool used by service providers to manage backup services, could allow an attacker to take over user accounts. By manipulating the password reset process, an attacker can trick the system into sending a reset link that directs the user's secret credentials to the attacker instead of the legitimate site. If a user clicks this malicious link in their email, the attacker can gain full access to their account.

Technologies: [Veeam Service Provider Console](https://junglewise.ai/threats/technologies/service-provider-console). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-64635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64635 being exploited in the wild.

**How severe is CVE-2026-64635?** Medium severity, with a CVSS score of 5.3, published 30 July 2026.

**Which products and versions are affected?** Veeam Service Provider Console 9.2.1.33875 and earlier.

**Is there a fix for CVE-2026-64635?** A patch was published on 2026-07-28: KB updated with fix information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64635 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-64635?** Check whether you run Veeam Service Provider Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Weak Password Recovery Mechanism (CWE-640) exists in the Veeam Service Provider Console due to improper validation of the 'returnUrl' parameter. An unauthenticated remote attacker can craft a password reset request that specifies an attacker-controlled domain in the 'returnUrl' field. When the targeted user receives the legitimate password reset email and clicks the link, the embedded reset token is transmitted to the attacker's server via the Referer header or direct redirection. This allows the attacker to capture the token and complete the password reset process to hijack the account. The vulnerability is resolved in version 9.2.1.33875.

## Affected products

- Veeam Service Provider Console 9.2.1.33875 and earlier

## Timeline

- 2026-05-27: disclosed: Initial KB publication
- 2026-07-28: patched: KB updated with fix information
- 2026-07-30: advisory: NVD publication date

## References

- [https://www.veeam.com/kb4853](https://www.veeam.com/kb4853)

## Related threats

- [Veeam Service Provider Console agent impersonation](https://junglewise.ai/threats/cve-2026-58073-veeam-service-provider-console-agent-impersonation)
- [Veeam Service Provider Console arbitrary file write and RCE](https://junglewise.ai/threats/cve-2026-58072-veeam-service-provider-console-arbitrary-file-write-and-rce)
- [Veeam Service Provider Console unauthenticated admin API access](https://junglewise.ai/threats/cve-2026-58071-veeam-service-provider-console-unauthenticated-admin-api-access)
- [Veeam Service Provider Console memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-58067-veeam-service-provider-console-memory-exhaustion-denial-of)
- [Veeam Service Provider Console remote code execution in alarm management](https://junglewise.ai/threats/cve-2026-32998-veeam-service-provider-console-remote-code-execution-in-alarm)