Agent For Windows
Monthly
Local arbitrary file write in Veeam Agent for Microsoft Windows allows an authenticated low-privileged local user to escalate integrity impact when an administrator installs or runs the agent. The vulnerability requires a privileged install/run action during the attack window and a non-trivial precondition such as controlling a target filesystem path (e.g., junction/symlink), making exploitation gated and low-to-moderate priority. No public exploit was identified at time of analysis.
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.
Local arbitrary file write in Veeam Agent for Microsoft Windows allows an authenticated low-privileged local user to escalate integrity impact when an administrator installs or runs the agent. The vulnerability requires a privileged install/run action during the attack window and a non-trivial precondition such as controlling a target filesystem path (e.g., junction/symlink), making exploitation gated and low-to-moderate priority. No public exploit was identified at time of analysis.
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.