CVE-2025-64391
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
Veeam Agent for Windows
CVSS
4.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 13.1Agent for WindowsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Affected versions 1
- Agent for Windowsaffected: all versions before 13.1CVE List