Veeam Agent CVE-2025-48982

Exploitation requires a system administrator to be tricked into restoring an attacker-supplied malicious file through Veeam Agent for Microsoft Windows' restore functionality; the malicious file is then processed with elevated privileges, yielding local privilege escalation. Limiting factors that reduce realistic risk: the attack vector is local (AV:L), it requires active user interaction (UI:R) by a privileged administrator performing a deliberate restore operation, and it depends on successful social engineering rather than any autonomous or remote trigger. It applies to the Windows agent specifically; no special non-default configuration is indicated in the available data.

This is a moderate-priority local privilege escalation (CWE-269) in Veeam Agent for Microsoft Windows carrying a CVSS 3.1 base score of 7.8. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows a local attack vector with low complexity and no attacker privileges required, but exploitation is gated behind user interaction (UI:R) - specifically a system administrator being socially engineered into restoring a malicious file. Although PR:N keeps the score high, the real-world risk is tempered by the fact that the victim must be a privileged operator who takes a deliberate, non-routine action (restoring an attacker-supplied file), which is a meaningful barrier compared to a fully unauthenticated remote flaw. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the high CVSS is driven by the full C/I/A impact (privilege escalation to higher rights) rather than by demonstrated widespread exploitability. Net assessment: patch in normal cadence and prioritize where admins routinely restore externally-sourced backups - treat as a solid-but-not-emergency fix rather than a drop-everything issue. Note the input lacks EPSS/KEV/POC signals entirely, so the exploitation-likelihood dimension cannot be independently corroborated.

An attacker crafts a malicious backup/restore file and uses social engineering to convince a Windows system administrator to restore it via Veeam Agent. When the privileged administrator performs the restore, the malicious content is processed with elevated rights, escalating the attacker's control to that privilege level. No public exploit code was identified at time of analysis, and the local vector plus required admin interaction (UI:R) make this a targeted rather than mass-exploitable scenario.