Veeam's May Patch Beat September's Public Exploit by 4 Months
Security / news
Veeam's May Patch Beat September's Public Exploit by 4 Months
CVE-2026-32996 lets a standard Windows user become SYSTEM through Veeam Agent's backup service, a flaw Veeam fixed in May before a researcher's proof-of-concept exposed it four months later.
A standard Windows user with local access to a machine running Veeam Agent can become NT AUTHORITY\SYSTEM by abusing a named pipe the backup software leaves unguarded, under CVE-2026-32996, a flaw Veeam patched in May and a researcher demonstrated with working exploit code four months later.
Veeam's own advisory dates the fix to May 27
Veeam's advisory, KB4852, credits Alibaba, reported through HackerOne, with finding the bug and rates it 7.3 of 10 under CVSS 4.0. The company fixed it in Veeam Backup & Replication 13.0.2.29, which updates the Windows agent to build 13.0.3.1220, published May 27, 2026.
A session ID written in plain text is the whole bug
The flaw sits in how the Veeam Endpoint Backup service handles admin-level sessions over a local gRPC named pipe, \\.\pipe\Veeam\VAW\ServiceConnectionPipe. The service caches an administrator identity against a session ID the client controls, and that ID is written in plain text to a log file, C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, that any standard user can read. An attacker who copies the ID out of the log can present it back to the pipe and run commands as SYSTEM.
| Milestone | Date |
|---|---|
| Veeam ships fix (Backup & Replication 13.0.2.29) | May 27, 2026 |
| Researcher suce0155 posts public PoC on GitHub | Sept. 14, 2026 |
| CVE-2026-32996 listed in CISA's KEV catalog | Not listed as of Sept. 24, 2026 |
The gap went unremarked for months
A security researcher posting as suce0155 published working proof-of-concept code at github.com/suce0155/cve-2026-32996 on Sept. 14, 2026. Security Affairs and Cyber Security News both dated their coverage of it the same week. Veeam Agent for Microsoft Windows versions through 13.0.1.2067, and all earlier version 13 builds, remain exposed if the update was never applied.
The score overstates what is actually confirmed
Coverage of the release has called it active exploitation, which overstates what any named source has confirmed. Security Affairs, citing security firm Arctic Wolf, reported only that the public proof-of-concept "increas[es] the risk that threat actors may incorporate the issue into post-compromise attack chains," not that Arctic Wolf had observed the technique used against a real target. CISA's Known Exploited Vulnerabilities catalog, which tracks confirmed in-the-wild use, does not list CVE-2026-32996 as of Sept. 24, 2026.
The precondition matters for triage: an attacker needs to already run code as some standard user on the target host, since Veeam's advisory describes no remote trigger. That puts it in the same category as N-able's local-privilege-escalation bug, where the company denied active exploitation days before confirming it. It is also the second remote-access or backup product this month to draw a critical-adjacent score for a locally triggerable flaw; ConnectWise's ScreenConnect file-transfer bug carried a 9.9 rating the same week suce0155's proof-of-concept went public.
Exploitation still requires local access first, which limits the flaw mostly to attackers who already have a foothold, an accomplice with a legitimate account, or unattended physical access to the machine. Veeam Backup & Replication 13.0.2.29 or later resolves it; there is no workaround short of installing the update.
Sources
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.