Loading vulnerability…
Local Privilege Escalation in Versa SASE Client for Windows Audit Log Export
CVE-2025-34290 is a local privilege-escalation vulnerability in the audit log export functionality of Versa SASE Client for Windows releases 7.8.7 through 7.9.4. A privileged service processes user-controlled file paths without impersonating the requesting user. Improper privilege handling, combined with a time-of-check/time-of-use race condition and symbolic-link or mount-point manipulation, permits an authenticated local attacker to cause arbitrary directory deletion with SYSTEM privileges. The condition can be chained with MSI rollback techniques to execute code as NT AUTHORITY\SYSTEM.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated local attacker can induce a privileged service to delete arbitrary directories as SYSTEM. Deletion of protected system directories can be leveraged through MSI rollback techniques to obtain execution as NT AUTHORITY\SYSTEM, resulting in full local system compromise.
If you can’t patch tonight, do this now.
Restrict untrusted users' ability to manipulate sensitive directories and monitor for suspicious directory deletions associated with the Versa SASE Client audit log export operation. Apply a vendor-provided patched Versa SASE Client release when one is available for the deployed version.
Patch, then assume compromise.
Update Versa SASE Client for Windows to a vendor-provided version that addresses CVE-2025-34290. Verify that the deployed client version is outside the affected 7.8.7 through 7.9.4 release range.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.