A newly discovered privilege escalation flaw in Veeam Agent for Microsoft Windows could allow attackers with local access to compromised endpoints to execute commands as NT AUTHORITYSYSTEM.
Public proof-of-concept (PoC) code for CVE-2026-32996 was released on September 14, increasing the urgency for organizations to patch affected Veeam deployments.
CVE-2026-32996 impacts Veeam Agent for Microsoft Windows builds associated with version 13.0.1.2067 and earlier releases of version 13.
The vulnerability has been addressed in Veeam Backup & Replication version 13.0.2.29, which updates the Windows agent to build 13.0.3.1220.
A public PoC repository indicates that agent version 13.0.3.1220 is fully patched, while versions 13.0.2.1102 and earlier remain vulnerable.
Veeam Agent Vulnerability
The issue lies in the Veeam Endpoint Backup service, which exposes its local control plane via the gRPC named pipe: \.pipeVeeamVAWServiceConnectionPipe.
The service includes named-pipe client identity checks and authorization controls to differentiate between standard users, backup operators, administrators, and SYSTEM-level operations.
However, researchers found that Veeam’s elevated session mechanism relies on a client-supplied session UID instead of securely binding that identifier to the user’s identity or a specific named-pipe connection.
When an administrator elevates the Veeam Endpoint Tray application through User Account Control (UAC), the service stores the administrator’s ClaimsPrincipal in an elevated-client cache indexed by a GUID-based session UID.
A locally authenticated low-privileged user can connect to the service pipe and present a known elevated UID, potentially leading the service to mistakenly treat that user’s request as authorized for administrative operations.
The security weakness is exacerbated by the fact that elevated session identifiers are recorded in the file C:ProgramDataVeeamEndpointSvc.VeeamEndpointBackup.log.
Standard users can reportedly access this file, allowing a local attacker to search for an active elevated GUID and reuse it before the administrator’s Veeam tray session disconnects, times out, or closes.
A GitHub repository published by security researcher “suce0155” contains PoC code and a demonstration showing a command executed under the SYSTEM security context. The PoC searches the Veeam service log for a valid GUID, then exploits the active session to launch a command.
The exploit requires local access and is not remotely exploitable by itself. However, it can significantly increase the impact of other compromises.
An attacker who gains access through phishing, malware, a weak local account, or an existing remote-access foothold could use this flaw to take full control of a vulnerable Windows endpoint.
Patch and Mitigation Guidance
Organizations should promptly identify endpoints running vulnerable Veeam Agent for Microsoft Windows versions and prioritize remediation for:
- Shared workstations and multi-user systems
- Administrator workstations and help-desk endpoints
- Backup servers and systems used by backup operators
- Servers containing sensitive data or privileged credentials
The primary fix is to upgrade Veeam Backup & Replication to version 13.0.2.29 or later, which deploys Veeam Agent for Windows build 13.0.3.1220. Administrators should validate both the Veeam Agent service and tray component versions after deployment.
Until patching is complete, defenders should restrict interactive local access, minimize unnecessary local administrator and backup-operator privileges, and monitor for suspicious reads of the Veeam Endpoint Backup log, unexpected named-pipe activities, and anomalous SYSTEM-level process creation.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
