CVE-2025-64394: Veeam Veeam Backup for Microsoft 365 vulnerability
Published Oct 27, 2026
·Updated
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
Affected Software
1 affected component
Veeam Veeam Backup for Microsoft 365
Event History
Oct 27, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Systems on which Veeam Backup for Microsoft 365 is being installed are exposed if a low-privileged user has local access during the installation process.
2
What does an attacker need to exploit it?
An attacker needs low-privileged local access and must be able to act during installation. The issue allows arbitrary file writes with SYSTEM privileges.
3
What could exploitation achieve?
Successful exploitation can lead to local privilege escalation or denial of service.