Veeam Agent EUVD-2026-94226

Requires the attacker to already hold a local, low-privileged authenticated account (PR:L) on a Windows system where Veeam Agent for Microsoft Windows is installed and running; the flaw is reached locally through the agent's process-control functionality with no user interaction. It is NOT remotely exploitable (AV:L) and its impact is limited to availability - terminating processes - with no data disclosure or modification. Limiting factors: the need for pre-existing local access and the Veeam Agent being installed; realistic severity rises only where terminating processes (e.g. security agents or backup services) materially harms the host.

This is a medium-severity local authorization flaw (CWE-862, Missing Authorization) in Veeam Agent for Microsoft Windows that lets any low-privileged local user terminate arbitrary processes. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: local attack vector, low complexity, low privileges required, no user interaction, and an availability-only impact (VA:H) with no confidentiality or integrity effect - matching a process-kill primitive. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or probable exploitation. In practical terms this is NOT a drop-everything priority: it cannot be reached remotely and requires an attacker to already have an authenticated local foothold, after which the only impact is denial of service (e.g. killing security agents, backup jobs, or other defensive processes). Note a data conflict: the input Tags label this 'Authentication Bypass,' but both CWE-862 (Missing Authorization) and the description describe an authorization failure, not authentication bypass - the tag appears mislabeled and should not drive triage. Prioritize as a privilege/hardening issue, patch during normal cycles, and weight higher only on hosts where process termination could disable security or backup tooling.

An attacker who already has a standard (non-administrative) local account or has gained an unprivileged foothold on a Windows host running Veeam Agent abuses the missing authorization check to terminate arbitrary processes. They could kill endpoint security tooling, the Veeam Agent's own backup service, or other critical processes to cause denial of service or disable defenses ahead of further activity. No public exploit code was identified at the time of analysis, and the attack requires no user interaction but does require local authenticated access.