This vulnerability in Veeam Agent for Microsoft Windows

CVE-2026-32996 is a local privilege escalation in Veeam Agent for Microsoft Windows affecting all version 13 builds prior to 13.0.3.1220 (includes 13.0.1.2067 and 13.0.2.1102). The Veeam Endpoint Backup service caches elevated administrator session UIDs in C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log—a file readable by any local user. An attacker with low-privilege local access reads a valid session GUID from the log, then replays it over the service's gRPC named pipe (\\.\pipe\Veeam\VAW\ServiceConnectionPipe). The service never verifies the caller's identity against the session—it only checks that the GUID matches a cached elevated session—so it happily executes the attacker's commands as NT AUTHORITY\SYSTEM. The CWE-532 (Insertion of Sensitive Information into Log File) root cause makes this 100% reliable: no heap spray, no race condition, just read a file and quote a GUID.

Veeam rates this HIGH at CVSS v4.0 7.3, which is honest about the local-access prerequisite but underweights the deployment context. Veeam Agent isn't a peripheral utility—it's the backup agent sitting on production database servers, domain controllers, and the Veeam B&R server itself. Ransomware operators have repeatedly targeted Veeam components (CVE-2023-27532, CVE-2024-40711) specifically because SYSTEM on a backup host means the power to wipe recovery data before detonation. Arctic Wolf confirmed active exploitation as of September 16, 2026, and a weaponized PoC (suce0155/CVE-2026-32996) has been public since September 14. The original flaw was reported by Alibaba via HackerOne and disclosed May 28, 2026—giving defenders nearly four months of patch lead time that is now expired.

1. Patch to Veeam Agent 13.0.3.1220 immediately — Given active exploitation, override the standard HIGH 30-day mitigation window—deploy the patch within hours. Update Veeam Backup & Replication to 13.0.2.29+ via KB4852, which pushes the fixed agent build automatically. Prioritize backup servers, B&R servers, domain controllers, and production database servers first, then sweep the remaining agent fleet. The noisgate remediation SLA for HIGH is 180 days, but the active-exploitation override means you should not wait.
2. Harden ACLs on the Veeam service log directory — Set C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log to SYSTEM and BUILTIN\Administrators-only read access via icacls. This breaks the first step of the exploit chain (standard-user log file read). Deploy via GPO immediately as a compensating control while patching proceeds. Test that Veeam backup jobs still function after the ACL change.
3. Deploy EDR detection for named pipe abuse and SYSTEM child processes — Create behavioral rules for: (1) connections to \\.\pipe\Veeam\VAW\ServiceConnectionPipe from non-Veeam processes (Sysmon 17/18); (2) child process creation from Veeam.EndPoint.Service.exe where the child is cmd.exe, powershell.exe, net.exe, or whoami.exe. Push within 24 hours. Arctic Wolf notes their managed detection covers multiple stages of this exploitation chain.
4. Restrict local interactive access on backup infrastructure hosts — Review and minimize local logon rights on Veeam B&R servers and backup repository hosts. Remove unnecessary users from the local Users and Remote Desktop Users groups. Enforce MFA for all RDP sessions. This raises the barrier to the initial local-access prerequisite. Deploy within the noisgate mitigation SLA override (hours, given active exploitation).
5. Audit Veeam-stored credentials for lateral movement risk — Veeam B&R stores credentials for managed hosts. If an attacker gains SYSTEM on a Veeam server, they can extract these credentials. Rotate all Veeam-managed credentials after patching. Ensure Veeam service accounts use dedicated, least-privilege accounts—not Domain Admin.

Run on each target Windows host where Veeam Agent may be installed. No admin privileges required for the version check. Example invocation: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-32996.ps1. For fleet-wide scanning, push via SCCM, Intune, or your RMM tool and collect exit codes.

# Check-CVE-2026-32996.ps1
# Detects whether Veeam Agent for Windows is vulnerable to CVE-2026-32996
# Local Privilege Escalation via session UID leak in service log file
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN / NOT INSTALLED

$ErrorActionPreference = 'SilentlyContinue'

$agentVersion = $null

# Method 1: Check registry for Veeam Agent version
$regPaths = @(
    'HKLM:\SOFTWARE\Veeam\Veeam Agent for Microsoft Windows',
    'HKLM:\SOFTWARE\Veeam\Veeam Endpoint Backup'
)
foreach ($rp in $regPaths) {
    $reg = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
    if ($reg -and $reg.Version) {
        $agentVersion = $reg.Version
        break
    }
}

# Method 2: Fallback to service binary version
if (-not $agentVersion) {
    $svc = Get-WmiObject Win32_Service -Filter "Name='VeeamEndpointBackupSvc'" -ErrorAction SilentlyContinue
    if ($svc -and $svc.PathName) {
        $exePath = $svc.PathName.Trim('"')
        if (Test-Path $exePath) {
            $agentVersion = (Get-Item $exePath).VersionInfo.ProductVersion
        }
    }
}

# Method 3: Fallback to Uninstall registry
if (-not $agentVersion) {
    $uninstKeys = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue
    foreach ($key in $uninstKeys) {
        $props = Get-ItemProperty $key.PSPath -ErrorAction SilentlyContinue
        if ($props.DisplayName -match 'Veeam Agent') {
            $agentVersion = $props.DisplayVersion
            break
        }
    }
}

if (-not $agentVersion) {
    Write-Host 'UNKNOWN - Veeam Agent for Windows not detected on this host.'
    exit 2
}

Write-Host "Detected Veeam Agent version: $agentVersion"

try {
    $detected = [System.Version]$agentVersion
} catch {
    Write-Host "UNKNOWN - Could not parse version string: $agentVersion"
    exit 2
}

$minAffected  = [System.Version]'13.0.0.0'
$fixedVersion = [System.Version]'13.0.3.1220'

if ($detected -lt $minAffected) {
    Write-Host 'PATCHED - Version is below 13.0 (not affected by CVE-2026-32996).'
    exit 0
}

if ($detected -ge $fixedVersion) {
    Write-Host 'PATCHED - Version >= 13.0.3.1220. CVE-2026-32996 is fixed.'
    exit 0
}

# Version is in the affected range
Write-Host 'VULNERABLE - Veeam Agent version is in the affected range (13.0.x < 13.0.3.1220).'

# Check exploit precondition: is the log file world-readable?
$logPath = 'C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log'
if (Test-Path $logPath) {
    Write-Host "WARNING: Vulnerable log file exists at $logPath"
    $acl = Get-Acl $logPath -ErrorAction SilentlyContinue
    if ($acl) {
        $readable = $acl.Access | Where-Object {
            $_.IdentityReference -match 'BUILTIN\\Users|Everyone|Authenticated Users' -and
            $_.FileSystemRights -match 'Read'
        }
        if ($readable) {
            Write-Host 'WARNING: Log file is readable by standard users (exploit precondition MET).'
        } else {
            Write-Host 'NOTE: Log file ACL appears hardened (exploit precondition may be mitigated).'
        }
    }
} else {
    Write-Host 'NOTE: Log file not currently present (precondition not yet met, but may appear after admin activity).'
}

exit 1

1. Arctic Wolf — Active Exploitation Advisory (Sep 2026)
2. Veeam KB4852 — Vendor Security Advisory
3. Tenable — CVE-2026-32996 Detail
4. NVD — CVE-2026-32996
5. suce0155 — Public PoC Exploit (GitHub)
6. The Hacker News — Zyxel and Veeam Flaws Under Active Exploitation
7. SecurityOnline — Actively Exploited Veeam Agent Vulnerability PoC
8. Veeam KB4738 — VBR 13 Release Information