Veeam Agent Flaw Actively Exploited to Gain SYSTEM Privileges on Windows
Public PoC for CVE-2026-32996 lets local users escalate to SYSTEM through Veeam Agent for Windows.
CVE-2026-32996 is a local privilege escalation flaw in Veeam Agent for Microsoft Windows 13.0.1.2067 and earlier 13 builds. A low-privileged user can reuse an elevated session UID, recovered from the readable Svc.VeeamEndpointBackup.log file, to make the Veeam Endpoint Backup service run commands as NT AUTHORITY\SYSTEM through a local gRPC named pipe. Researcher suce0155 published details and proof-of-concept code on September 14, 2026, demonstrated with whoami. Veeam fixed it in agent build 13.0.3.1220, delivered by Veeam Backup & Replication 13.0.2.29 or later, and no vendor workaround is available.
- CVE-2026-32996 lets a local user gain SYSTEM on Windows.
- Affected builds are Veeam Agent 13.0.1.2067 and earlier 13.x.
- Public PoC reads session UIDs from a readable Veeam log.
- Fixed in agent 13.0.3.1220; no vendor workaround exists.
- CVEs
- CVE-2026-32996
- Vendors
- Veeam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32996 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation | 7.3 | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
A critical local privilege escalation flaw in Veeam Agent for Microsoft Windows is drawing attention after public proof-of-concept exploit code became available. The vulnerability, tracked as CVE-2026-32996, could let a low-privileged local user run commands with NT AUTHORITY\SYSTEM permissions on affected Windows devices. Technical details and exploit code were publicly released on September 14, 2026, […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.