CVE-2025-64394
Quick assessment
Affected
Veeam Backup for Microsoft 365
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Veeam Backup for Microsoft 365 安装过程中，存在一个安全漏洞，允许低权限的本地用户以 SYSTEM 权限写入任意文件，从而导致权限提升或拒绝服务。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Veeam | Backup for Microsoft 365 | 8.0≤ 8.6.0.1102 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-64394
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1386
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Veeam | Backup for Microsoft 365 | 8.0 ~ 8.6.0.1102 | - |
|
II. Public POCs for CVE-2025-64394
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-64394
请登录查看更多情报信息。
Other References for CVE-2025-64394 (1)
Same Patch Batch · Veeam · 2026-10-27 · 9 CVEs total
| CVE-2026-108142 | 9.1 CRITICAL | CDP Coordinator 服务未授权绕过漏洞 |
| CVE-2026-106076 | 9.0 CRITICAL | Veeam Backup for Microsoft 365 SQL 注入漏洞 |
| CVE-2026-107671 | 8.5 HIGH | 管理员凭据可全局禁用多因素认证绕过漏洞 |
| CVE-2026-106077 | 8.3 HIGH | Veeam Backup for Microsoft 365 任意文件读取漏洞 |
| CVE-2026-105477 | 7.3 HIGH | Veeam Agent for Linux 本地提权漏洞 |
| CVE-2026-106078 | 6.9 MEDIUM | Veeam Backup for Microsoft 365 认证绕过漏洞 |
| CVE-2026-108141 | 5.9 MEDIUM | Nas 备份服务相对路径遍历漏洞 |
| CVE-2026-108140 | 5.9 MEDIUM | 备份服务器相对路径遍历漏洞（Restore Operator 角色） |