Veeam's May Patch Beat September's Public Exploit by 4 Months

A standard Windows user with local access to a machine running Veeam Agent can become NT AUTHORITY\SYSTEM by abusing a named pipe the backup software leaves unguarded, under CVE-2026-32996, a flaw Veeam patched in May and a researcher demonstrated with working exploit code four months later.

Veeam's own advisory dates the fix to May 27

Veeam's advisory, KB4852, credits Alibaba, reported through HackerOne, with finding the bug and rates it 7.3 of 10 under CVSS 4.0. The company fixed it in Veeam Backup & Replication 13.0.2.29, which updates the Windows agent to build 13.0.3.1220, published May 27, 2026.

A session ID written in plain text is the whole bug

The flaw sits in how the Veeam Endpoint Backup service handles admin-level sessions over a local gRPC named pipe, \\.\pipe\Veeam\VAW\ServiceConnectionPipe. The service caches an administrator identity against a session ID the client controls, and that ID is written in plain text to a log file, C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, that any standard user can read. An attacker who copies the ID out of the log can present it back to the pipe and run commands as SYSTEM.

Milestone	Date
Veeam ships fix (Backup & Replication 13.0.2.29)	May 27, 2026
Researcher suce0155 posts public PoC on GitHub	Sept. 14, 2026
CVE-2026-32996 listed in CISA's KEV catalog	Not listed as of Sept. 24, 2026

The gap went unremarked for months

A security researcher posting as suce0155 published working proof-of-concept code at github.com/suce0155/cve-2026-32996 on Sept. 14, 2026. Security Affairs and Cyber Security News both dated their coverage of it the same week. Veeam Agent for Microsoft Windows versions through 13.0.1.2067, and all earlier version 13 builds, remain exposed if the update was never applied.

The score overstates what is actually confirmed

Coverage of the release has called it active exploitation, which overstates what any named source has confirmed. Security Affairs, citing security firm Arctic Wolf, reported only that the public proof-of-concept "increas[es] the risk that threat actors may incorporate the issue into post-compromise attack chains," not that Arctic Wolf had observed the technique used against a real target. CISA's Known Exploited Vulnerabilities catalog, which tracks confirmed in-the-wild use, does not list CVE-2026-32996 as of Sept. 24, 2026.

The precondition matters for triage: an attacker needs to already run code as some standard user on the target host, since Veeam's advisory describes no remote trigger. That puts it in the same category as N-able's local-privilege-escalation bug, where the company denied active exploitation days before confirming it. It is also the second remote-access or backup product this month to draw a critical-adjacent score for a locally triggerable flaw; ConnectWise's ScreenConnect file-transfer bug carried a 9.9 rating the same week suce0155's proof-of-concept went public.

Exploitation still requires local access first, which limits the flaw mostly to attackers who already have a foothold, an accomplice with a legitimate account, or unattended physical access to the machine. Veeam Backup & Replication 13.0.2.29 or later resolves it; there is no workaround short of installing the update.