{"affected":[{"defaultStatus":"unaffected","product":"Backup for Microsoft 365","source":"CNA: hackerone","vendor":"Veeam","versions":[{"lessThanOrEqual":"8.6.0.1102","status":"affected","version":"8.0","versionType":"semver"}]}],"cveId":"CVE-2025-64394","cwes":["CWE-1386"],"description":"A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.","epss":{"date":"2026-11-04","percentile":0.01159,"score":0.00107},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: hackerone","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793814410609,"publishedAt":1793117818979,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://www.veeam.com/kb4957"}],"remediation":[],"revision":"e8c97ee22da500a93e186978e6d3c26e6bf53e351a44907eedb15809f7370ef3","sources":[{"modifiedAt":1793814410609,"name":"CNA: hackerone","retrievedAt":1793815701194,"url":"https://www.cve.org/CVERecord?id=CVE-2025-64394"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793815820800,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64394"}],"ssvc":{"assessedAt":1793814399362,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2025-64394","updatedAt":1793815820800}