How severe is CVE-2025-64391?

CVE-2025-64391 has a CVSS 4.0 base score of 4.1, rated medium severity.

Is CVE-2025-64391 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-64391?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2025-64391 published?

CVE-2025-64391 was published on 2026-10-07 and last updated on 2026-10-19.

CVE-2025-64391

CVE-2025-64391 is a medium-severity vulnerability with a CVSS 4.0 base score of 4.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1386.

Key facts

Severity: Medium (CVSS 4.0 base score 4.1)
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1386
Published: 2026-10-07
Last modified: 2026-10-19

Description

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.

Frequently asked questions

What is CVE-2025-64391?: This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
How severe is CVE-2025-64391?: CVE-2025-64391 has a CVSS 4.0 base score of 4.1, rated medium severity.
Is CVE-2025-64391 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-64391?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2025-64391 published?: CVE-2025-64391 was published on 2026-10-07 and last updated on 2026-10-19.

References

https://www.veeam.com/kb4902

Other CWE-1386 vulnerabilities

CVE-2026-56857 — Critical (CVSS 9.8): On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation…
CVE-2025-58074 — High (CVSS 8.8): A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A…
CVE-2024-7400 — High (CVSS 8.5): The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected…
CVE-2024-36340 — Medium (CVSS 6.6): A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points,…
CVE-2026-41116 — Medium (CVSS 6.3): Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access…
CVE-2023-40623 — Medium (CVSS 6.2): SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory…

Browse all CWE-1386 vulnerabilities →