Veeam Agent EUVD-2026-111125

Exploitation requires local, low-privileged access (AV:L, PR:L) to a host running Veeam Agent for Linux, AND the installation must be managed by a Veeam Backup & Replication instance - the description explicitly states that only such managed installations are affected, so standalone/unmanaged Agent for Linux deployments are not exploitable. The flaw is an untrusted search path (CWE-426), and the CVSS 4.0 AT:P metric reflects that success depends on this managed-deployment condition outside the attacker's control. Limiting factors: there is no remote vector (local access mandatory), a pre-existing low-privilege foothold is needed, and only the managed deployment mode and affected versions (13.1 before 13.1.2) are vulnerable. The sources do not describe exactly how the search path is triggered.

This is a genuine but moderate-priority issue rather than an emergency. The sole supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, score 7.3) describes a LOCAL privilege-escalation flaw (CWE-426, untrusted search path): the attacker must already have local, low-privileged access (PR:L) to a Linux host running Veeam Agent for Linux, and exploitation depends on a condition beyond the attacker's control (AT:P) - namely that the install is managed by a Veeam Backup & Replication instance. There is no remote vector, so mass or internet-facing exploitation is not in scope. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the data, so this is 'no public exploit identified at time of analysis'; exploitation probability cannot be quantified from the inputs. The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with a high-impact (VC:H/VI:H/VA:H → full host compromise once triggered) but access-gated local flaw. A vendor patch is available, so the realistic posture is: schedule the update promptly for affected managed Linux agents, but this is not a drop-everything remote RCE. Note the AT:P metric is driven by the 'managed by Veeam Backup & Replication' precondition rather than any timing/race mechanism - the sources do not describe the trigger mechanism.

An attacker (or malicious process) with an existing low-privileged local account on a Linux server where Veeam Agent for Linux is deployed and managed by a Veeam Backup & Replication server abuses an untrusted search path (CWE-426) to have the agent load an attacker-controlled binary or library, executing it with the agent's elevated (root) privileges. Because the CVSS vector is local (AV:L) and requires low privileges (PR:L), a foothold on the host is a prerequisite; no public exploit code is identified in the available data.