CVE-2025-64391: CWE-1386 Insecure Operation on Windows Junction / Mount Point in Veeam Agent for Windows

This vulnerability (CVE-2025-64391) in Veeam Agent for Windows arises from insecure handling of Windows junctions or mount points. A low-privileged local user can exploit this flaw to influence the agent to write files to arbitrary filesystem locations when an administrator installs the software. The CVSS 4.0 base score is 4.1, indicating medium severity, with attack vector local, low attack complexity, partial attack requirements, and high impact on integrity and availability. No known exploits are reported in the wild. The affected versions are all versions prior to 13.1.

The vulnerability allows a low-privileged local user to cause the Veeam Agent for Windows to write files to arbitrary locations during installation by an administrator. This could potentially lead to unauthorized file writes, which may impact system integrity and availability. There is no indication of confidentiality impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor Veeam's advisories for updates. Until a fix is available, limit local user privileges and control administrative installation processes to reduce risk.