A local privilege escalation vulnerability exists in Veeam Agent for Linux, allowing a local user to gain elevated privileges on affected installations that are managed by a Veeam Backup & Replication instance. The weakness is a classic untrusted search path flaw, classified as CWE-426, and could enable an attacker to execute arbitrary commands with higher privileges, compromising system integrity and confidentiality.

The vulnerability targets installations of Veeam Agent for Linux that are managed by a Veeam Backup & Replication server. No specific product versions are listed, so any managed instance may be impacted.

The CVSS score of 7.3 indicates a high severity. The EPSS score is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local system access or the ability to run processes on the host to exploit this flaw, suggesting that the risk is scoped to local users.