Public PoC Exposes Critical Veeam Agent Privilege Escalation
Public PoC for CVE-2026-32996 lets low-privileged local users gain SYSTEM on Veeam Agent for Windows; patch to 13.0.2.29 or later.
CVE-2026-32996 is a local privilege escalation affecting Veeam Agent for Microsoft Windows up to version 13.0.1.2067; public technical details and a GitHub PoC were released on September 14, 2026. The flaw lets the service cache an elevated administrator principal against a client-controlled session UID over the gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe, and valid UIDs are written to a log file readable by standard users. An attacker with basic local access can copy a UID and execute commands as NT AUTHORITY\SYSTEM. The fix is upgrading to Veeam Backup & Replication 13.0.2.29 or later (Agent build 13.0.3.1220); no official workaround exists.
- LPE to NT AUTHORITY\SYSTEM affects Veeam Agent for Windows through 13.0.1.2067
- Public PoC and technical details released on GitHub September 14, 2026
- Elevated session UIDs leak to log file readable by standard users
- Patch via Veeam Backup & Replication 13.0.2.29+; no official workaround
- CVEs
- CVE-2026-32996
- Organizations
- VeeamArctic Wolf
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32996 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation | 7.3 | <1% | PoC |
From the original article
3 min read at securityaffairs.comA Veeam Agent flaw lets local users gain SYSTEM privileges. A public PoC is available, raising the risk of exploitation on shared Windows systems. If you’re running Veeam Agent on a Windows endpoint with more than one local user, now’s the time to check the version, not tomorrow.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.