Local File Write Vulnerability in Veeam Backup for Microsoft 365
CVE-2025-64394

4.3MEDIUM

Key Information:

Vendor

Veeam
Status
Backup For Microsoft 365
Vendor
CVE Published:
27 October 2026

What is CVE-2025-64394?

A vulnerability exists that permits a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation process of Veeam Backup for Microsoft 365. This could potentially enable the user to escalate privileges or facilitate a denial of service attack, posing serious security risks for affected systems.

Affected Version(s)

Backup for Microsoft 365 8.0 <= 8.6.0.1102

References

https://www.veeam.com/kb4957

CVSS V4

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.