CVE-2026-32996 Under Active Exploitation: What Defenders Should Do Now

Overview

CVE-2026-32996 is a high-severity local privilege escalation in Veeam Agent for Microsoft Windows, rated 7.3 under CVSS v4. Researchers report active exploitation in the wild, and public proof-of-concept code has been disclosed, sharply lowering the effort required to attack unpatched endpoints.

Mechanism and exploitation conditions

The Veeam Endpoint Backup service caches an elevated administrator principal against a client-controlled session UID while handling sessions over the local gRPC named pipe \.\pipe\Veeam\VAW\ServiceConnectionPipe. The UID is not bound to the requesting user or connection, so another local process can reuse it.
Elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which standard users can read. Reading a valid UID and replaying it yields command execution as SYSTEM. The public proof-of-concept runs commands and captures output to a file.

Impact

Successful exploitation grants NT AUTHORITY\SYSTEM, allowing defense evasion, persistence, credential theft, and lateral movement. Because the vulnerable component is a backup agent, attackers may also reach backup repositories and recovery data.

Affected products and versions

• Veeam Agent for Microsoft Windows 13.0.1.2067
• All earlier version 13 builds

Remediation and mitigation

Patch to Veeam Backup & Replication 13.0.2.29 or later, which updates the agent to build 13.0.3.1220. If that is not immediately possible, restrict interactive local access on affected endpoints, limit local administrator and backup operator privileges, and monitor for anomalous SYSTEM-level activity. Prioritize shared servers and administrator workstations.

Sources

• SecurityOnline: Actively Exploited Veeam Agent Vulnerability PoC Disclosed
• Veeam security advisories (vendor)
• CVE-2026-32996 record