CVE-2025-64391 Overview
CVE-2025-64391 affects Veeam Agent for Microsoft Windows. A low-privileged local user can coerce the agent, when invoked by an administrator, into writing files to arbitrary filesystem locations. The flaw is categorized under [CWE-1386] (Insecure Operation on Windows Junction/Mount Point). Veeam published advisory KB4902 describing the issue and corrected builds.
The vulnerability requires local access and user interaction from an administrator but can be used to tamper with protected files on the host.
Critical Impact
A standard Windows user can redirect agent file operations to overwrite integrity-protected files once an administrator runs the installer or triggers the privileged write, enabling local privilege escalation paths.
Affected Products
- Veeam Agent for Microsoft Windows (versions prior to the fix published in Veeam KB4902)
Discovery Timeline
- 2026-10-07 - CVE-2025-64391 published to the National Vulnerability Database
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2025-64391
Vulnerability Analysis
The weakness falls under [CWE-1386] insecure operation on Windows junction and mount points. Veeam Agent for Microsoft Windows performs privileged file write operations during installation or agent-managed activity. A low-privileged local account can prepare the filesystem layout so that these writes resolve to attacker-chosen targets.
Because the privileged process does not sufficiently validate the final destination of its file operations, writes can land outside the intended directory. The attacker has no control over file content directly, but can corrupt or replace integrity-sensitive files on the host.
Exploitation requires an administrator to perform the install or trigger the agent action. This gates the attack behind user interaction, but installer-time windows are predictable and reachable by any logged-in user.
Root Cause
The agent follows filesystem reparse points — junctions, mount points, or symbolic links — placed by an unprivileged user before the privileged write occurs. The code path does not canonicalize or validate the final target before opening files for writing, which allows redirection to arbitrary paths.
Attack Vector
The attacker needs an existing low-privilege shell on the Windows host. They create a junction or symbolic link pointing from a directory the agent writes to toward a sensitive target such as a file in C:\Windows\System32. When an administrator runs the Veeam Agent installer or triggers the vulnerable operation, the agent follows the junction and writes to the attacker-chosen path. Refer to Veeam KB4902 for additional technical specifics.
Detection Methods for CVE-2025-64391
Indicators of Compromise
- Creation of junctions, mount points, or symbolic links under directories used by Veeam Agent (for example, user-writable temporary or staging paths) prior to agent installation or execution.
- Veeam Agent processes writing files to paths outside the installation directory, particularly to C:\Windows, C:\Program Files, or other system locations.
- Unexpected changes to system binaries, scheduled tasks, or service configurations shortly after a Veeam Agent installation or upgrade.
Detection Strategies
- Monitor for CreateSymbolicLink, mklink /J, or DeviceIoControl calls with FSCTL_SET_REPARSE_POINT from non-administrative processes targeting Veeam-related directories.
- Alert on file writes by VeeamAgent.exe or related installer processes whose target path resolves outside the expected installation tree.
- Correlate low-privileged process activity preparing reparse points with subsequent elevated writes by Veeam processes within a short time window.
Monitoring Recommendations
- Enable Windows filesystem auditing on directories used by Veeam Agent during install and runtime, and forward events to a central analytics platform.
- Baseline normal Veeam Agent write locations and alert on deviations.
- Track installer executions performed by administrators on shared or multi-user systems where other users can preposition reparse points.
How to Mitigate CVE-2025-64391
Immediate Actions Required
- Upgrade Veeam Agent for Microsoft Windows to the fixed version listed in Veeam KB4902.
- Avoid installing or running the Veeam Agent on hosts where untrusted users hold interactive sessions until patched.
- Audit multi-user Windows systems for pre-existing junctions or symbolic links in Veeam-related paths.
Patch Information
Veeam addressed the vulnerability in the updated builds referenced in Veeam Knowledge Base article KB4902. Administrators should apply the latest Veeam Agent for Microsoft Windows release and verify version numbers on each managed endpoint after rollout.
Workarounds
- Restrict interactive logon on servers that host Veeam Agent to administrative users only, removing the local attacker precondition.
- Perform Veeam Agent installations and upgrades from clean, single-user maintenance windows where no untrusted sessions are active.
- Remove write permissions for standard users on any staging directories referenced by the Veeam Agent installer.
# Verify installed Veeam Agent version on a Windows host
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Veeam\Veeam Endpoint Backup' | Select-Object DisplayVersion"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.