# CVE-2025-34290: Versa SASE Client for Windows privilege escalation in audit log export

Source: https://junglewise.ai/threats/cve-2025-34290-versa-sase-client-for-windows-privilege-escalation-in-audit-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-34290 · Severity: high · CVSS 7.8 · Published 2025-12-20

Versa SASE Client is a Secure Access Service Edge (SASE) software agent for Windows that manages network security and access policies. A vulnerability in its audit log export feature allows a local user on the same system to delete protected system folders and take complete control of the computer by exploiting improper privilege handling and race conditions. An attacker could use this to disable security controls or steal sensitive data by running malicious commands as the highest system privilege level.

Vendors: [Versa-Networks](https://junglewise.ai/threats/vendors/versa-networks).

## Quick answers

**Is CVE-2025-34290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34290 being exploited in the wild.

**How severe is CVE-2025-34290?** High severity, with a CVSS score of 7.8, published 20 December 2025.

**Which products and versions are affected?** Versa-Networks SASE Client for Windows 7.8.7 through 7.9.4.

**Is there a fix for CVE-2025-34290?** A patch was published on 2025-12-20: Fixed in version 7.9.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34290 attacked?** It is attacked with local access.

**Am I affected by CVE-2025-34290?** Check whether you run Versa-Networks SASE Client for Windows or Versa-Networks Sase Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This local privilege escalation vulnerability exists in the audit log export functionality of Versa SASE Client versions 7.8.7 through 7.9.4. The vulnerable privileged service receives user-controlled file paths without impersonating the requesting user before performing file system operations. The flaw combines a time-of-check time-of-use (TOCTOU) race condition with symbolic link and mount point manipulation to allow a local authenticated attacker to coerce deletion of arbitrary directories with SYSTEM privileges. An attacker can exploit this to delete protected system folders like C:\Config.msi and subsequently achieve code execution as NT AUTHORITY\SYSTEM via MSI rollback techniques. The fix is available in version 7.9.5 and later.

## Affected products

- Versa Networks SASE Client for Windows 7.8.7 through 7.9.4

## Timeline

- 2025-12-20: disclosed
- 2025-12-20: patched: Fixed in version 7.9.5

## References

- [https://security-portal.versa-networks.com/emailbulletins/69421e33d03aafc8e5bdaf21](https://security-portal.versa-networks.com/emailbulletins/69421e33d03aafc8e5bdaf21)
- [https://www.vulncheck.com/advisories/versa-sase-client-for-windows-arbitrary-file-deletion-leading-to-lpe](https://www.vulncheck.com/advisories/versa-sase-client-for-windows-arbitrary-file-deletion-leading-to-lpe)