Veeam Backup EUVD-2025-211203

Exploitation requires an existing local, low-privileged account on the Windows host running Veeam Backup for Microsoft 365 (PR:L, AV:L), and the arbitrary SYSTEM file write occurs specifically during installation of the product - so the attacker must coincide with, or trigger, an administrator running the installer (UI:A active interaction). CWE-1386 indicates the flaw involves insecure handling of a Windows junction/mount point, implying the attacker must have a junction/symlink staged in the targeted path (reflected as AT:P, attack requirement present), though the exact trigger is not described in the available sources. Limiting factors that reduce real-world risk: it is not remotely exploitable, needs a prior local foothold, is only exposed during the install/upgrade window rather than continuous runtime, and depends on administrator-initiated interaction. Affected builds are Backup for Microsoft 365 8.0 through 8.6.0.1102; updating per Veeam KB4957 is the remediation indicated by the evidence.

This is a genuinely low-to-moderate priority issue, not a high-CVSS emergency - the input CVSS 4.0 base score is 4.3 (Medium), and every signal reinforces constrained, local-only exploitability rather than mass remote risk. The CVSS vector is AV:L/AC:L/AT:P/PR:L/UI:A, meaning an attacker must already have a local low-privileged foothold on the Windows host, a specific attack requirement must be present (AT:P), and active user interaction is required (UI:A) - namely an administrator running the installer. No EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no POC or exploit reference is present in the input, so this is 'no public exploit identified at time of analysis.' The reporting channel is HackerOne (coordinated disclosure) and the vuln.today priority is 'this_month,' which aligns with a patch-on-normal-cycle posture rather than act_now/emergency. The primary impact is availability (VA:H, supporting the denial-of-service outcome) with partial integrity impact (VI:L, from the arbitrary SYSTEM-level file write) and no confidentiality impact (VC:N). One caveat: CWE-1386 (Insecure Operation on a Windows Junction/Mount Point) implies a symlink/junction-abuse mechanism, but the description does not spell out the trigger, so the exact exploitation technique is inferred from the CWE, not confirmed by the advisory text.

A low-privileged local user on a Windows server stages the environment (consistent with CWE-1386, likely a pre-planted junction or mount point in a predictable install path) and waits for, or induces, an administrator to run the Veeam Backup for Microsoft 365 installer. During installation the installer writes a file as SYSTEM into an attacker-influenced location, letting the attacker overwrite or plant files as SYSTEM to escalate privileges or crash the service. No public exploit code is identified in the provided data, and success depends on local access plus the installation actually running.