CVE-2025-64391

Executive Summary

CVE-2025-64391 is a local privilege escalation vulnerability in Veeam Agent for Microsoft Windows that allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it. The flaw requires administrator-level installation of the agent but then permits unprivileged users on the same system to influence file write operations outside intended directories. Successful exploitation can lead to system compromise through malicious file placement, potentially enabling code execution with elevated privileges.

Technical Analysis

This vulnerability is classified under CWE-1386, which addresses improper handling of insufficiently protected credentials or sensitive information. However, based on the NVD description, the core issue is an improper control over file write operations, allowing a low-privileged user to influence the agent's file writing behavior. The vulnerability manifests during the agent installation process and subsequent operation.

The attack surface is local: an attacker must have existing access to the Windows host where Veeam Agent is installed. The vulnerability is triggered when the agent performs file write operations — likely during backup, restore, or logging activities — and fails to validate the destination path or the user's authority to write to that location. Because the agent runs with SYSTEM privileges (typical for backup software), writing to arbitrary locations can overwrite critical system files, configuration files, or executable paths, leading to privilege escalation or persistence.

The requirement that an administrator installs the agent suggests the vulnerability may involve a service, scheduled task, or driver component that inherits administrative rights. A low-privileged user could then interact with this component — through IPC, named pipes, file system redirection, or manipulation of user-writable directories that the agent later processes — to redirect file writes to sensitive locations.

No specific function names, API endpoints, or file paths are provided in the NVD description. The exact mechanism (e.g., path traversal, symlink following, insecure temporary file creation, DLL hijacking via writable directories) cannot be confirmed from available data. The vulnerability class is consistent with privilege escalation via arbitrary file write, a well-known pattern in Windows software.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker gains low-privileged local access to a Windows host (e.g., via phishing, compromised credentials, or lateral movement). They verify that Veeam Agent for Microsoft Windows is installed and running as a service or scheduled task with elevated privileges.

2. Triggering the flaw class: The attacker identifies a mechanism by which the agent writes files based on user-controllable input — for example, a user-writable directory, a configuration setting, a log path, or a restore target. They manipulate this input to point to a privileged location (e.g., C:\Windows\System32, startup folders, or service binaries). The agent, lacking proper validation, performs the write.

3. Payload/execution method: At the vulnerability-class level, the attacker supplies a crafted file (executable, DLL, script, or configuration file) that the agent writes to a sensitive location. Depending on the write target, this may result in:

   • Overwriting a legitimate executable or DLL with malicious code.
   • Dropping a file into a startup directory or scheduled task path.
   • Modifying a service binary path via configuration file replacement.

4. Post-exploitation impact: Upon next execution or system restart, the malicious file is loaded with SYSTEM or administrative privileges, granting the attacker full control of the host. This can be used for persistence, credential dumping, disabling security controls, or further lateral movement.

No public PoC or exploit code is available. The attack chain is inferred from the vulnerability class (arbitrary file write with privilege escalation impact). Specific implementation details cannot be verified from the provided data.

Impact Assessment

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates:

• Confidentiality: High — attacker can read sensitive data, possibly including backup contents or system secrets.
• Integrity: High — arbitrary file writes enable tampering with system files, backups, or configurations.
• Availability: High — overwriting critical files can cause denial of service or system instability.
• Privileges Required: Low — attacker needs only standard user access.
• User Interaction: Required — the scenario specifies an administrator installs the agent, implying the vulnerability is only exploitable after installation by a privileged user.

The blast radius is limited to the local host, but in enterprise environments where Veeam Agent is widely deployed, a single compromised workstation could be escalated to full system control, potentially leading to domain-wide compromise if the host has cached credentials or network access to backup infrastructure.

Detection Guidance

Sigma Rule

title: Veeam Agent Arbitrary File Write Exploitation Attempt
id: 6a3c9e2f-8b4d-4c1a-9f7e-2d5b8c1a3e4f
status: experimental
description: Detects suspicious file write operations by Veeam Agent to non-standard locations, indicative of CVE-2025-64391 exploitation.
author: Threat Intelligence Team
date: 2025-04-09
logsource:
  product: windows
  service: sysmon
detection:
  selection_process:
    Image|endswith:
      - '\VeeamAgent.exe'
      - '\Veeam.EndPoint.Manager.exe'
      - '\VeeamDeploymentSvc.exe'
  selection_file:
    EventID: 11
    TargetFilename|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\'
  condition: selection_process and selection_file
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate Veeam Agent updates or configuration changes
level: high

YARA Rule

rule CVE_2025_64391_Veeam_Agent_Arbitrary_Write
{
    meta:
        description = "Detects potential exploitation of CVE-2025-64391 via suspicious Veeam Agent file write behavior"
        author = "Threat Intelligence Team"
        date = "2025-04-09"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64391"
        severity = "high"

    strings:
        $veeam1 = "Veeam Agent" ascii wide nocase
        $veeam2 = "VeeamAgent.exe" ascii wide nocase
        $veeam3 = "Veeam.EndPoint" ascii wide nocase
        $path1 = "System32" ascii wide nocase
        $path2 = "Startup" ascii wide nocase
        $path3 = "Temp" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D) and
        ($veeam1 or $veeam2 or $veeam3) and
        ($path1 or $path2 or $path3)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2025-64391 Veeam Agent Arbitrary File Write Attempt"; flow:to_server,established; content:"Veeam"; nocase; content:"System32"; nocase; distance:0; within:100; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

process where process.name == "VeeamAgent.exe" and
  file where file.path : ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")

Splunk SPL Query

index=windows EventCode=11 Image="*\\VeeamAgent.exe" OR Image="*\\Veeam.EndPoint.Manager.exe"
| where match(TargetFilename, "(?i)C:\\\\Windows\\\\(System32|SysWOW64)\\\\") OR match(TargetFilename, "(?i)Startup")
| stats count by host, Image, TargetFilename, User
| where count > 0

Wazuh OSSEC Rule

<group name="windows,sysmon,">
  <rule id="100001" level="12">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.image">VeeamAgent\.exe$|Veeam\.EndPoint\.Manager\.exe$</field>
    <field name="win.eventdata.targetFilename">C:\\Windows\\System32\\|C:\\Windows\\SysWOW64\\|Startup</field>
    <description>CVE-2025-64391: Veeam Agent attempted to write to a sensitive system location</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict local interactive logon and restrict execution of Veeam Agent management interfaces to trusted administrators only.
   • Monitor and audit file system activity for Veeam Agent processes writing outside expected backup and log directories.
   • Apply the principle of least privilege: ensure low-privileged users cannot modify directories that Veeam Agent uses for configuration, logs, or temporary storage.
   • Consider application whitelisting to prevent unauthorized executables from running, even if written to disk.

2. Patch/upgrade steps:

   • No official patch is available. Monitor Veeam's security advisories and release notes for updates addressing CVE-2025-64391.
   • When a patch is released, test and deploy it promptly across all affected systems.

3. Long-term hardening:

   • Implement endpoint detection and response (EDR) rules to flag arbitrary file writes by backup agents.
   • Regularly review and harden service permissions and file system ACLs on hosts running Veeam Agent.
   • Segment backup infrastructure from general user workstations to limit lateral movement.
   • Conduct periodic vulnerability assessments and penetration tests focusing on local privilege escalation.

References

1. NVD — CVE-2025-64391: https://nvd.nist.gov/vuln/detail/CVE-2025-64391
2. CWE-1386 — Improper Handling of Insufficiently Protected Credentials: https://cwe.mitre.org/data/definitions/1386.html
3. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. Veeam Security Advisories: https://www.veeam.com/security-advisories.html
5. CISA KEV Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence available at this time.