Veeam Agent Flaw Actively Exploited for SYSTEM Privilege Escalation
A critical local privilege escalation vulnerability in Veeam Agent for Microsoft Windows, CVE-2026-32996, is being actively exploited by attackers to gain SYSTEM privileges.
A critical local privilege escalation flaw in Veeam Agent for Microsoft Windows is drawing significant attention following the public release of proof-of-concept exploit code. The vulnerability, identified as CVE-2026-32996, allows a low-privileged local user to execute commands with the highest level of privileges on affected Windows systems, specifically NT AUTHORITY\SYSTEM permissions. The public disclosure of technical details and exploit code on September 14, 2026, has heightened the risk of this vulnerability being integrated into post-compromise attack chains by threat actors.
The vulnerability affects Veeam Agent for Microsoft Windows versions 13.0.1.2067 and earlier within the 13 build series. The core of the issue lies within the Veeam Endpoint Backup service, which manages privileged client operations through a local gRPC named pipe. Researchers discovered that the service improperly handles an elevated administrator identity, linking it to a client-controlled session UID that is not securely validated against the originating user or pipe connection. This oversight permits a local attacker to reuse an existing elevated session identifier and trick the Veeam service into executing commands with SYSTEM-level authority.
Exploitation requires an attacker to first obtain local access to the target system. This initial access can be achieved through various means, including phishing campaigns, compromised credentials, malware infections, or exploited remote access vulnerabilities. Once local access is established, the attacker can proceed to exploit CVE-2026-32996. The necessary session identifiers, which are crucial for the exploit, can reportedly be retrieved from the Svc.VeeamEndpointBackup.log file located in the C:\ProgramData\Veeam\Endpoint\ directory. Since standard local users have read permissions for this log file, an attacker with limited privileges can easily locate a valid UID and then present it to the exposed service interface.
Publicly available exploit code demonstrates the feasibility of this attack by successfully locating a GUID within the Veeam log file and executing the Windows whoami command. The output of this command is redirected to a file, confirming that the process was indeed running under the NT AUTHORITY\SYSTEM account. This level of access grants an attacker complete control over the affected Windows machine.
Achieving SYSTEM privileges on a Windows system is highly advantageous for attackers. It grants them the highest permission level, enabling them to disable security software, access sensitive data, alter system configurations, establish persistent access, steal credentials, and facilitate lateral movement across the network. The ability to disable security tools is particularly concerning, as it can blind defenses and allow attackers to operate undetected for extended periods.
Veeam has responded to this critical vulnerability by releasing a patch. The fix is available in Veeam Agent for Microsoft Windows build 13.0.3.1220. Organizations utilizing Veeam Backup & Replication should update to version 13.0.2.29 or later, which includes the patched Windows agent. Security teams are advised to identify all systems running vulnerable versions of Veeam Agent and prioritize remediation efforts, especially on shared workstations, servers, administrator endpoints, and devices managed by backup operators or help desk personnel, as these systems are often at higher risk due to the increased likelihood of local access.
Currently, no vendor-supported workaround is available for CVE-2026-32996. The primary and most effective mitigation is to upgrade affected Veeam Agent installations to the patched release. Until patching can be completed, organizations should implement interim measures to reduce their exposure. These include limiting interactive access to vulnerable endpoints, rigorously reviewing local account permissions, restricting the rights granted to backup operators and administrators, and closely monitoring for any suspicious activity related to the Veeam Endpoint Backup service, its log files, and any unexpected processes launched with SYSTEM privileges.