Veeam Service Provider Console CVE-2026-64635

The attack requires only that the Veeam Service Provider Console Forgot Password function be network-accessible and that the attacker know a valid registered email address for a portal user. No authentication, administrative access, or special configuration is required to initiate the malicious reset request - the CVSS vector PR:N confirms this. The critical limiting condition is user interaction: the attack cannot succeed without the targeted user clicking the attacker-crafted reset link delivered via email (CVSS UI:R). If the organization's email security controls flag or quarantine reset emails from unexpected domains, or if users are trained to verify the domain in password reset links, exploitation is blocked at the delivery stage. The attack is also bounded to accounts that have a valid email address in the VSPC system; accounts with multi-factor authentication that applies post-reset may reduce but not eliminate post-exploitation access depending on implementation.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.3) captures the network reachability and lack of required privileges accurately, and AC:H reflects the dependency on victim interaction. However, the I:N assignment likely understates real-world impact: successful exfiltration of the reset token enables the attacker to reset the victim's password and take full control of the account, constituting a meaningful integrity impact. The overall risk is meaningfully higher than the moderate CVSS score implies for environments where VSPC administrators manage large MSP customer estates, since a compromised portal account could grant visibility into and control over backup infrastructure spanning multiple tenants. No EPSS score was present in the available data, and KEV status is not confirmed, meaning quantitative exploitation probability cannot be cited. That said, the attack technique requires only knowledge of a target's email address, no authentication, and only one user action (clicking a plausible-looking password reset email), making it practically low-friction despite the AC:H rating. The primary limiting factor is deliverability: the attack is contingent on the targeted user clicking the reset email, introducing a social-engineering dependency. VSPC is deployed primarily by service providers, meaning a compromised account may carry disproportionate downstream blast radius across managed customer environments.

An attacker identifies the email address of a VSPC administrator or portal user - obtainable via OSINT or from prior phishing activity - and submits a Forgot Password request to the VSPC login page, injecting their own server URL (e.g., https://attacker.example/capture) as the returnUrl parameter. Veeam generates and emails a password reset link to the legitimate user containing the attacker's domain and the valid one-time reset token. When the user clicks the link expecting to reset their password, the reset code is HTTP-transmitted to the attacker's server; the attacker uses the captured token against the legitimate VSPC portal to reset the user's password and authenticate as them. No public proof-of-concept code has been identified at time of analysis, though the technique is mechanically simple and does not require exploit development skills.