Loading vulnerability…
Local Privilege Escalation in Veeam Agent for Microsoft Windows
CVE-2025-24287 is a directory-permission vulnerability in Veeam Agent for Microsoft Windows that allows local users to modify directory contents and thereby execute arbitrary code with elevated privileges. The specific affected directory and vulnerable function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local user can escalate privileges by manipulating directory contents to cause arbitrary code execution with elevated permissions, potentially compromising the confidentiality, integrity, and availability of the affected system.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting local interactive or shell access to the Veeam server, minimizing the number of users with local logon capability, reviewing and hardening filesystem permissions on application directories, and monitoring for unauthorized directory-content changes on the host. Because the issue is locally exploitable, restricting access to trusted administrators only is an important interim measure. Specific vendor mitigation guidance beyond patching is not available in the provided content.
Patch, then assume compromise.
Upgrade Veeam Agent for Microsoft Windows to version 6.3.2.1205 or a later release containing the fix. This is the explicitly identified Agent release addressing CVE-2025-24287; the exact affected-version range is not established.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.