Reported by 4 outlets
Veeam Agent CVE-2026-32996 actively exploited
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.51 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CVE-2026-32996 is a critical local privilege escalation in Veeam Agent for Microsoft Windows that lets a low-privileged local attacker execute code as NT AUTHORITY\SYSTEM. The flaw affects version 13.0.1.2067 and earlier Version 13 builds. Public technical analysis and proof-of-concept exploit code appeared on September 14, and exploitation has been confirmed in the wild, which turns this from a waiting risk into an active post-exploitation tool.
Arctic Wolf's analysis pins the bug in the Veeam Endpoint Backup service, which manages elevated client sessions over the local gRPC named pipe \.\pipe\Veeam\VAW\ServiceConnectionPipe. The service caches an elevated administrator principal using a session UID that the client controls but that is not cryptographically or logically bound to the user initiating the request or to the underlying named-pipe connection. A local attacker who reuses a valid elevated session identifier gets command execution in the SYSTEM context, which means the ability to alter security settings, disable endpoint protections, access protected files, create privileged accounts, establish persistence, and move laterally.
Patch Veeam Agent to a fixed build on every endpoint that runs it, since the agent fleet is by definition a SYSTEM-level foothold on most machines. With a public PoC available since September 14, assume adoption into intrusion chains: audit endpoints for unexplained SYSTEM-level activity around backup service pipes, and watch for the flaw appearing in post-exploitation tooling alongside the usual driver and antenna of privilege escalation exploits.
Timeline
-
original reporting
A critical exploited Veeam Agent vulnerability (CVE-2026-32996) is under active attack. Public PoC exploit code has been disclosed. Update s
securityonline.info · 21d ago · September 22nd, 2026
A critical exploited Veeam Agent vulnerability (CVE-2026-32996) is under active attack. Public PoC exploit code has been disclosed. Update s
via Mastodon https://securityonline.info/actively-exploited-veeam-agent-vulnerability-poc/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cyberpress.org
Hackers Exploit Veeam Agent Flaw to Gain SYSTEM Privileges on Windows
cyberpress.org · 21d ago · September 22nd, 2026
A newly disclosed active exploitation of a critical local privilege escalation flaw in Veeam Agent for Microsoft Windows that enables attackers to elevate low-privileged access to NT AUTHORITY\SYSTEM on vulnerable endpoints. Tracked as CVE-2026-32996 , the vulnerability affects Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier Version 13 builds. Public technical analysis and proof-of-concept exploit code became available on September 14, significantly increasing the risk that threat actors and post-exploitation operators will adopt the flaw in real-world intrusion chains. Hackers Exploit Veeam Agent Flaw The vulnerability exists in the Veeam Endpoint Backup service, which manages elevated client sessions over the local gRPC named pipe \.\pipe\Veeam\VAW\ServiceConnectionPipe . According to Arcticwolf , the service caches an elevated administrator principal using a session UID that is controlled by the client but is not cryptographically or logically bound to the user initiating the request or to the underlying named-pipe connection. This design weakness allows a local attacker to reuse a valid elevated session identifier and request command execution in the context of the Windows SYSTEM account. SYSTEM-level access gives an attacker near-complete control of the affected machine, including the ability to alter security settings, disable endpoint protections , access protected files, create privileged accounts, establish persistence, and move deeper into an ente
-
update from gbhackers.com
Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows
gbhackers.com · 21d ago · September 22nd, 2026
A newly discovered privilege escalation flaw in Veeam Agent for Microsoft Windows could allow attackers with local access to compromised endpoints to execute commands as NT AUTHORITY\SYSTEM. CVE-2026-32996 impacts Veeam Agent for Microsoft Windows […] The post Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from korben.info
📢 [VULN] Veeam Agent for Windows: a flaw that grants SYSTEM rights (CVE-2026-32996)
korben.info · 19d ago · September 24th, 2026
If you run Veeam Agent for backup, take note. via Mastodon https://korben.info/veeam-agent-windows-faille-droits-system.html