Versa SASE Client CVE-2025-34290

Exploitation requires an authenticated local Windows user session on a host running Versa SASE Client versions 7.8.7 through 7.9.4; no administrator or elevated privileges are required prior to exploitation (CVSS PR:L confirmed). The audit log export functionality must be accessible to the user's account. The attack additionally requires winning a TOCTOU race window to interpose a symbolic link or mount point between the service's path resolution and its deletion operation - this timing dependency may necessitate multiple attempts or a looped exploit. Critical limiting factors: (1) local authenticated access is mandatory - the CVSS AV:L vector confirms this is not remotely exploitable over a network without prior foothold; (2) the affected version range 7.8.7-7.9.4 must be present on the target; and (3) for the described SYSTEM execution path, the Windows Installer subsystem must be present and C:\Config.msi must be reachable via the redirected deletion.

The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) correctly characterizes this as a local, low-privileged attack with a full-system compromise outcome. The attack surface is bounded to endpoints where the Versa SASE Client is deployed and where a threat actor already holds an authenticated local session - insider threats, compromised user accounts, and post-initial-access lateral movement scenarios are the primary concern. The AT:N classification in the provided CVSS 4.0 vector warrants scrutiny: the description explicitly references a TOCTOU race condition, which CVSS 4.0's AT:P (Present) metric is designed to capture; the assigned AT:N may understate exploitation complexity and should be verified with the vendor. No CISA KEV listing and no confirmed public PoC are present in the provided intelligence, and no EPSS score was included, reducing urgency somewhat versus a weaponized flaw. However, the MSI rollback technique used in the final escalation step is a well-documented Windows attack primitive with existing tooling in the security research community, meaning an attacker with local access and Windows internals knowledge could develop a working exploit without novel research. The deletion-to-SYSTEM execution path is deterministic once the race is won, making overall reliability high for patient attackers. Organizations relying on Versa SASE as their zero-trust endpoint control should treat this as a meaningful priority: compromise of the endpoint security agent directly undermines the architectural guarantees it is meant to provide.

An attacker holding a standard local user account on a Windows host running Versa SASE Client 7.8.7-7.9.4 initiates an audit log export with a crafted path, then races to replace the target location with a directory junction or symbolic link pointing to C:\Config.msi before the privileged service completes its path resolution and deletion. Once the service removes C:\Config.msi as SYSTEM, the attacker stages a malicious MSI package and triggers a Windows Installer rollback, resulting in arbitrary code execution as NT AUTHORITY\SYSTEM. No public exploit code has been confirmed at time of analysis, but all underlying primitives - TOCTOU races, NTFS reparse points, and MSI rollbacks - are well-understood and have existing proof-of-concept tooling in the Windows privilege escalation research ecosystem.