CVE-2025-48982

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.veeam.com/kb4771	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:veeam:veeam_agent_for_windows:*:*:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad en Veeam Agent para Microsoft Windows permite la escalada de privilegios local si un administrador de sistemas es engañado para restaurar un archivo malicioso.

Information

Published : 2025-10-31 00:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-48982

Mitre link : CVE-2025-48982

CVE.ORG link : CVE-2025-48982

JSON object : View

Products Affected

veeam

veeam_agent_for_windows

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2025-48982", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48982", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-01T03:55:50.332994Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Veeam", "product": "Agent for Microsoft Windows", "versions": [{"status": "affected", "version": "4.7.2", "versionType": "semver", "lessThanOrEqual": "4.7.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-31T00:15:36.437", "references": [{"url": "https://www.veeam.com/kb4771", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file."}, {"lang": "es", "value": "Esta vulnerabilidad en Veeam Agent para Microsoft Windows permite la escalada de privilegios local si un administrador de sistemas es enga\u00f1ado para restaurar un archivo malicioso."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:veeam:veeam_agent_for_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B6D796B-E61F-4CC6-8469-4E95F7F0D8F4", "versionEndExcluding": "6.3.2.1302", "versionStartIncluding": "6.0.0.959"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}