Hardening Against CVE-2026-32996: Veeam Agent Privilege Escalation in Focus

Overview

CVE-2026-32996 is a high-severity local privilege escalation in Veeam Agent for Microsoft Windows, rated 7.3 under CVSS v4. It is reported as exploited in the wild and has public proof-of-concept code. Defenders should treat it as an urgent hardening item.

Mechanism and exploitation conditions

The Veeam Endpoint Backup service caches an elevated administrator principal against a client-controlled session UID while handling elevated sessions over the local gRPC named pipe \.\pipe\Veeam\VAW\ServiceConnectionPipe. The identifier is not bound to the requesting user or connection.
Elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, readable by standard users. An attacker reads a valid UID and replays it to execute commands as SYSTEM. The public proof-of-concept runs commands and writes output to a file.

Impact

Exploitation grants NT AUTHORITY\SYSTEM, enabling defense evasion, persistence, credential access, and lateral movement. Backup agents also manage sensitive recovery data, which broadens the consequences.

Affected products and versions

• Veeam Agent for Microsoft Windows 13.0.1.2067
• All earlier version 13 builds

Remediation and mitigation

Patch to Veeam Backup & Replication 13.0.2.29 or later, which updates the agent to the fixed build 13.0.3.1220. If patching is delayed, restrict interactive local access on affected endpoints and limit local administrator and backup operator privileges to required personnel. Prioritize shared servers and administrator workstations.

Sources

• SecurityOnline: Actively Exploited Veeam Agent Vulnerability PoC Disclosed
• Veeam security advisories (vendor)
• CVE-2026-32996 record