Veeam Agent CVE-2025-64391

Exploitation requires a low-privileged local user account on a Windows host AND that an administrator installs (or runs) the Veeam Agent for Microsoft Windows during the attack window - the privileged install/run action is what performs the arbitrary file write, mapped as UI:P (passive interaction) in the vector. The additional attack requirement (AT:P) indicates a non-trivial precondition such as controlling or racing a target filesystem path (e.g., via a junction/symlink, consistent with CWE-1386). Limiting factors: attack vector is local (no remote exploitation), the attacker must already be authenticated with low privileges (PR:L), and exploitation is gated on the privileged install/run occurring - it cannot be triggered purely by the attacker at will.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) confirms a local-only attack requiring an authenticated low-privileged user (PR:L), a specific additional attack precondition (AT:P), and passive user interaction (UI:P) - namely an administrator performing the install. Impact is integrity-only (VI:H) with no confidentiality or availability impact (VC:N/VA:N), consistent with an arbitrary file-write primitive (CWE-1386, insecure operation on Windows junction/mount point) that could be leveraged toward local privilege escalation. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Information Disclosure' tag directly conflicts with the CVSS data: the vector shows VC:N and VI:H, so this is a file-write/integrity flaw, not disclosure - the tag appears mislabeled and should be verified. The combination of local vector, required privileges, required admin install action, and extra attack requirement makes real-world mass exploitation unlikely; this is a defense-in-depth fix rather than an urgent patch.

On a system where an administrator is installing or has installed the Veeam Agent, a low-privileged local user who can influence a target path (e.g., via a crafted symlink/junction) coerces the privileged agent into writing a file to an arbitrary location, potentially overwriting a sensitive file to escalate privileges. The attack is local and requires the privileged install/run action to occur, and no public exploit code was provided in the available data.