Veeam Agent Flaw Actively Exploited to Gain SYSTEM Privileges on Windows

A critical local privilege escalation flaw in Veeam Agent for Microsoft Windows is drawing attention after public proof-of-concept exploit code became available.

The vulnerability, tracked as CVE-2026-32996, could let a low-privileged local user run commands with NT AUTHORITY\SYSTEM permissions on affected Windows devices.

Technical details and exploit code were publicly released on September 14, 2026, increasing the risk that threat actors may incorporate the issue into post-compromise attack chains. The flaw affects Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier 13 builds.

The issue exists in the Veeam Endpoint Backup service, which handles privileged client activity through a local gRPC named pipe located at \\.\pipe\Veeam\VAW\ServiceConnectionPipe.

Veeam Agent Flaw Actively Exploited

GitHub researcher suce0155 found that the service stores an elevated administrator identity against a client-controlled session UID that is not securely tied to the requesting user or original pipe connection.

This means a local attacker may reuse an elevated session identifier and persuade the Veeam service to run a command with SYSTEM-level rights. The required session identifiers can reportedly be recovered from the Svc.VeeamEndpointBackup.log file under C:\ProgramData\Veeam\Endpoint\.

Because standard local users can read this log file, an attacker with limited access may search it for a valid UID, then pass that identifier to the exposed service interface.

Public exploit code demonstrates the issue by locating a valid GUID in the Veeam log file and executing the Windows whoami command. The command output is written to a file, confirming that the process runs under the NT AUTHORITY\SYSTEM account.

While exploitation requires local access, attackers often obtain low-level access through phishing, stolen credentials, malware infections, or compromised remote-access accounts. SYSTEM privileges represent the highest permission level on most Windows systems.

A successful attacker could use this access to turn off security tools, access protected data, modify system configurations, establish persistence, steal credentials, or move laterally through an enterprise environment.

Veeam has addressed the issue in Veeam Agent for Microsoft Windows build 13.0.3.1220. Organizations should upgrade Veeam Backup & Replication to version 13.0.2.29 or later, which updates the Windows agent to the fixed build.

Security teams should identify systems running Veeam Agent version 13.0.1.2067 or older and prioritize remediation on shared workstations, servers, administrator endpoints, and devices used by backup operators or help desk personnel. These systems present greater risk because multiple users or privileged workflows can make local access more likely.

No reliable vendor-supported workaround has been identified for CVE-2026-32996. The primary mitigation is to upgrade affected Veeam Agent installations to a patched release.

Until patching is complete, organizations should reduce exposure by limiting interactive access to affected endpoints, reviewing local account permissions, restricting backup operator and administrator rights, and monitoring for suspicious activity involving the Veeam Endpoint Backup service, its log files, and unexpected child processes launched with SYSTEM privileges.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC