Veeam Agent For Windows
Monthly
Local privilege escalation in Veeam Agent for Microsoft Windows is triggered when a system administrator is socially engineered into restoring an attacker-supplied malicious file through the agent's restore function, which then processes that file with elevated privileges and grants the attacker higher-level access on the host. The issue is rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) per the authoritative assessment, and its practical risk is moderated by the local attack vector, the mandatory interaction of a privileged administrator, and the reliance on successful social engineering rather than any remote or autonomous trigger. No public exploit code has been identified and the vulnerability is not confirmed as actively exploited (no CISA KEV entry); only the Windows agent is affected, and no special non-default configuration is indicated in the available data.
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. Rated high severity (CVSS 7.0). No vendor patch available.
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation in Veeam Agent for Microsoft Windows is triggered when a system administrator is socially engineered into restoring an attacker-supplied malicious file through the agent's restore function, which then processes that file with elevated privileges and grants the attacker higher-level access on the host. The issue is rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) per the authoritative assessment, and its practical risk is moderated by the local attack vector, the mandatory interaction of a privileged administrator, and the reliance on successful social engineering rather than any remote or autonomous trigger. No public exploit code has been identified and the vulnerability is not confirmed as actively exploited (no CISA KEV entry); only the Windows agent is affected, and no special non-default configuration is indicated in the available data.
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. Rated high severity (CVSS 7.0). No vendor patch available.
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.