Veeam Agent for Windows contains a flaw that allows a local user with no elevated privileges to create or overwrite files at arbitrary locations once the agent has been installed by an administrator. The vulnerability does not directly grant code execution or data exfiltration, but based on the description, it is inferred that it can enable malicious or accidental configuration changes, tampering with backup scripts, or placing malware in directories that will later be processed by backup jobs. The weakness is identified as CWE‑1386, a file overwrite or create flaw where insufficient checks allow unwanted file creation.

The issue affects installations of Veeam Agent for Microsoft Windows. All versions recently installed by an administrator are vulnerable, as the application does not validate the file paths used when writing files from the point of view of the installer’s context. Any machine upon which the agent was installed in the administrative context is potentially impacted.

The CVSS score of 4.1 indicates a moderate severity. No EPSS score is published and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed live exploits. The vulnerability is local and requires that an administrator has already installed the agent; a low-privileged user could then exploit the flaw. Based on the description, it is inferred that the window of risk is limited to devices where the installation was performed by an administrator who did not enforce strict file‑write restrictions or follow recommended security hardening practices.