A critical vulnerability in Veeam Agent for Microsoft Windows is under scrutiny following the release of a public proof-of-concept exploit. The flaw allows low-privileged local users to execute commands with elevated NT AUTHORITYSYSTEM permissions on susceptible Windows machines.
Details of the Veeam Agent Vulnerability
The vulnerability, identified as CVE-2026-32996, surfaced after technical details and exploit code were made public on September 14, 2026. This disclosure raises the possibility of its exploitation in post-compromise strategies by cyber attackers. The affected versions include Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier builds.
The issue stems from the Veeam Endpoint Backup service, which facilitates privileged actions via a local gRPC named pipe. This service inadvertently stores an elevated administrator identity linked to a session UID that is not securely associated with the user or the original pipe connection.
Exploitation Mechanism and Risks
A GitHub researcher, known by the handle suce0155, discovered that attackers could exploit this flaw by reusing an elevated session identifier. This would enable the execution of commands with SYSTEM-level rights. The session identifiers can be extracted from the Svc.VeeamEndpointBackup.log file located in C:ProgramDataVeeamEndpoint.
Standard local users, who can access this log file, may locate a valid UID and leverage it to interact with the exposed service interface. Publicly available exploit scripts demonstrate how to locate a GUID within the log file and execute the Windows ‘whoami’ command, verifying SYSTEM-level execution.
Mitigation and Recommendations
Although exploiting this flaw requires local access, attackers frequently gain such access via phishing, stolen credentials, or malware. Once SYSTEM privileges are obtained, attackers can disable security tools, access sensitive data, alter system configurations, and move laterally across networks.
Veeam has resolved this issue in the Veeam Agent for Microsoft Windows build 13.0.3.1220. Organizations are urged to upgrade to Veeam Backup & Replication version 13.0.2.29 or newer, which includes the patched Windows agent.
Security teams should promptly identify and update systems running vulnerable versions, prioritizing shared workstations, servers, and devices used by administrators and backup operators. No vendor-supported workaround is available, making an upgrade essential.
Until updates are applied, minimizing exposure is crucial. This includes restricting interactive access to affected systems, reviewing local account permissions, limiting backup operator and administrator rights, and monitoring for unusual activity related to the Veeam Endpoint Backup service.
