Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows
Public PoC for CVE-2026-32996 lets local users escalate to SYSTEM on vulnerable Veeam Agent for Windows.
CVE-2026-32996 is a local privilege-escalation flaw in Veeam Agent for Microsoft Windows 13 builds through 13.0.1.2067. The Endpoint Backup service indexes elevated sessions by a client-supplied GUID that is logged in a file standard users can read, so a local attacker can replay an active administrator UID over the service named pipe and run commands as NT AUTHORITY\SYSTEM. A public PoC from researcher suce0155 was released on September 14. The fix is Veeam Backup & Replication 13.0.2.29, which ships agent build 13.0.3.1220; the issue is not remotely exploitable on its own.
- CVE-2026-32996 hits Veeam Agent for Windows builds through 13.0.1.2067 and earlier 13.x.
- Elevated session GUIDs in a readable service log can be replayed on the named pipe.
- Fixed by Veeam Backup & Replication 13.0.2.29, which ships agent build 13.0.3.1220.
- Public PoC needs an existing local foothold and is not remotely exploitable alone.
- CVEs
- CVE-2026-32996
- Vendors
- Veeam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32996 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation | 7.3 | <1% | PoC |
From the original article
2 min read at gbhackers.com
A newly discovered privilege escalation flaw in Veeam Agent for Microsoft Windows could allow attackers with local access to compromised endpoints to execute commands as NT AUTHORITY\SYSTEM. Public proof-of-concept (PoC) code for CVE-2026-32996 was released on September 14, increasing the urgency for organizations to patch affected Veeam deployments. CVE-2026-32996 impacts Veeam Agent for Microsoft Windows […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.