This vulnerability (CVE-2026-64635) in Veeam Service Provider Console arises from improper validation of the returnUrl parameter in the Forgot Password feature. An attacker can craft a password reset link that directs the reset code to a domain they control. If the targeted user clicks this link, the attacker receives the reset code, allowing them to take over the user's account. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated attacker to hijack user accounts by intercepting password reset codes. This compromises account confidentiality but does not affect integrity or availability. The attack requires user interaction and has a high complexity due to the need to trick users into clicking malicious links.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious of unsolicited password reset emails and verify the legitimacy of password reset links before clicking. No official fix or workaround has been published by the vendor at this time.