Veeam Agent for Microsoft Windows (Product): news timeline & CVEs

Veeam Agent Flaw Actively Exploited to Gain SYSTEM Privileges on Windows

Public PoC for CVE-2026-32996 lets local users escalate to SYSTEM through Veeam Agent for Windows.

CVE-2026-32996 is a local privilege escalation flaw in Veeam Agent for Microsoft Windows 13.0.1.2067 and earlier 13 builds. A low-privileged user can reuse an elevated session UID, recovered from the readable Svc.VeeamEndpointBackup.log file, to make the Veeam Endpoint Backup service run commands as NT AUTHORITY\SYSTEM through a local gRPC named pipe. Researcher suce0155 published details and proof-of-concept code on September 14, 2026, demonstrated with whoami. Veeam fixed it in agent build 13.0.3.1220, delivered by Veeam Backup & Replication 13.0.2.29 or later, and no vendor workaround is available.

Cyber Security NewsSep 22, 12:55 UTC · 4d agoExploit / PoC 4 sources CVE-2026-32996

Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows

Public PoC for CVE-2026-32996 lets local users escalate to SYSTEM on vulnerable Veeam Agent for Windows.

CVE-2026-32996 is a local privilege-escalation flaw in Veeam Agent for Microsoft Windows 13 builds through 13.0.1.2067. The Endpoint Backup service indexes elevated sessions by a client-supplied GUID that is logged in a file standard users can read, so a local attacker can replay an active administrator UID over the service named pipe and run commands as NT AUTHORITY\SYSTEM. A public PoC from researcher suce0155 was released on September 14. The fix is Veeam Backup & Replication 13.0.2.29, which ships agent build 13.0.3.1220; the issue is not remotely exploitable on its own.

GBHackersupdated Sep 22, 12:55 UTC · 4d agofirst Sep 22, 11:22 UTC · 4d agoExploit / PoC 4 sources CVE-2026-32996

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.

Zyxel disclosed a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273, CVSS 8.8) that enables OS command execution, with evidence of active exploitation.

The Hacker Newsupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 05:31 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-72733

Veeam Agent for Microsoft Windows

Timeline3 articles

Related CVEsby mentions

Appears with

Veeam Agent Flaw Actively Exploited to Gain SYSTEM Privileges on Windows

Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access