Quick answers
- Is CVE-2025-64391 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-64391 being exploited in the wild.
- How severe is CVE-2025-64391?
- Informational severity, published 7 October 2026.
- Which products and versions are affected?
- Veeam Agent for Microsoft Windows 13.0.4.1341 and earlier 13 and 6 builds.
- Is there a fix for CVE-2025-64391?
- Yes: fixed in Veeam Agent for Microsoft Windows 13.1 (build 13.1.0.544). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-64391 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2025-64391?
- Check whether you run Veeam Agent for Microsoft Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Veeam Agent for Microsoft Windows 13.1 (build 13.1.0.544)
Technical details
CVE-2025-64391 allows a local user to write arbitrary files with SYSTEM privileges by manipulating mount points and symbolic links during the Veeam Agent installation process. The vulnerability requires local access and occurs when an administrator installs the agent, creating a window for exploitation. An attacker gains the ability to write files to any location, enabling privilege escalation or code execution at SYSTEM level.
Affected products
- Veeam Agent for Microsoft Windows 13.0.4.1341 and earlier 13 and 6 builds
Timeline
- 2026-10-07: disclosed