CVE-2026-64635 Open redirect in Service Provider Console
An unauthenticated attacker can manipulate the password reset link domain to steal reset codes and take over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-64635?
CVE-2026-64635 is a medium-severity vulnerability in Veeam Service Provider Console, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.
Weakness: CWE-640
Which versions are affected by CVE-2026-64635?
How do I fix CVE-2026-64635?
No fix has been published for CVE-2026-64635 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64635 being exploited?
There is no known exploitation of CVE-2026-64635 in the wild and no public exploit code.
Sources
Also known as GHSA-r6vm-r9vq-cmwh.