CVE-2025-64394
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup
CVSS
—
Sin CVSS
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 27 oct 2026 · Última mod.: 28 oct 2026 · CWE-1386
0.1%EPSS · 30 días0.1%
2026-10-282026-10-31
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-568579.8 CRÍ46.2%
——14On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).24dCVE-2025-64391—1.6%
——0This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.13dCVE-2026-411166.3 MED0.3%
——0Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.102dCVE-2023-236974.7 MED7.3%
——2Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.
4d