Threat Summary
On 14 September 2026, public technical details and proof-of-concept (PoC) exploit code were released for CVE-2026-32996, increasing the likelihood of exploitation attempts against affected Veeam Agent for Microsoft Windows deployments.
CVE-2026-32996 is a local privilege escalation vulnerability in Veeam Agent for Microsoft Windows version 13.0.1.2067 and affects all earlier version 13 builds. Exploitation requires local access to a Windows endpoint running the affected agent, and can allow a low-privileged user to elevate to NT AUTHORITY\SYSTEM.
The issue stems from the Veeam Endpoint Backup service’s handling of elevated client sessions over the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe. The service caches an elevated administrator principal against a client-controlled session UID that is not bound to the requesting user or connection.
Because elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which standard users can read, an attacker can obtain a valid UID and abuse it to execute commands as SYSTEM. The public GitHub PoC demonstrates this by running whoami and writing the output to a file.
Arctic Wolf recommends prioritising remediation on shared workstations, servers, administrator workstations, and systems where local user access is available, or where compromise of a low-privileged account could lead to endpoint takeover.
Recommendations
Immediate Patch Installation:
- Upgrade Veeam Backup & Replication to 13.0.2.29 or later. This will also update the Veeam Agent for Windows to build 13.0.3.1220, which contains the fix.
- Identify endpoints running Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier and prioritise upgrades for systems with multiple local users, privileged workflows, or sensitive data.
- After upgrading, confirm that the Veeam Agent service and tray components are running the expected fixed versions.
Hardening:
- Limit interactive local access to endpoints running Veeam Agent for Microsoft Windows.
- Restrict local administrator and backup operator privileges to only required personnel.
Temporary Workarounds
No reliable vendor-supported workaround was identified in the public sources reviewed for this bulletin. The primary remediation is to upgrade affected Veeam Agent for Microsoft Windows installations to a fixed version.
Temporary Risk Reduction Steps
- Restrict local and interactive access to systems where affected Veeam Agent versions are installed.
- Prioritise patching on systems used by administrators, backup operators, help desk personnel, or other privileged users.
Arctic Wolf detects multiple stages of the CVE-2026-32996 Veeam Agent exploitation chain, and customers using the AWN Agent and/or Aurora Focus benefit from multi-stage endpoint detection. However, Arctic Wolf strongly recommends upgrading Veeam as the primary remediation for this vulnerability.
