The vulnerability allows a local user lacking special privileges to instruct the installation process of Veeam Backup for Microsoft 365 to write arbitrary files with SYSTEM privileges. This grants the user the ability to overwrite or create files that are normally protected, leading to privilege escalation or denial of service conditions. The flaw is identified as a Write Vulnerability (CWE-1386).

Veeam Backup for Microsoft 365 – the installation component that runs with SYSTEM rights during the setup process. No specific version data is available in the report.

The CVSS score of 4.3 classifies the flaw as low impact, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector is local during installation, requiring a low‑privileged user account to run the installer or install package. While no widespread exploitation has been documented, the local escalation path presents a moderate security risk in environments where untrusted accounts can install or update the product.