UPDATE: Active Exploitation CVE-2026-32996 | Arctic Wolf
CVE-2026-32996 is a local privilege escalation flaw in Veeam Agent for Microsoft Windows, allowing low-privileged users to gain SYSTEM via a vulnerable gRPC named pipe. CVE-2026-32996 allows low-privileged local users to escalate to SYSTEM on Windows endpoints running Veeam Agent. The flaw exists in the Veeam Endpoint Backup service's handling of elevated client sessions over a local gRPC named pipe. Attackers read cached session UIDs from a world-readable log file and abuse them to execute commands as SYSTEM.
Detection / Hunteropenrouter
Immediate Actions
- Upgrade Veeam Backup & Replication to 13.0.2.29 or later.
- Restrict local interactive access to systems running affected Veeam Agent versions.
- Prioritize patching on shared workstations and administrator systems.
Key Takeaways
- Public PoC exploit code released on September 14, 2026.
- Affects Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier version 13 builds.
- Exploitation abuses cached elevated session UIDs in the Veeam Endpoint Backup service.
- Standard users can read Svc.VeeamEndpointBackup.log to obtain valid elevated session UIDs.
- Fix requires upgrading to Veeam Backup & Replication 13.0.2.29 or later.
Attack Chain
- Initial Access: Attacker obtains low-privileged local access to a Windows endpoint running Veeam Agent.
- Discovery: Attacker reads Svc.VeeamEndpointBackup.log to find a cached elevated session UID.
- Privilege Escalation: Attacker sends the stolen UID over the gRPC named pipe to impersonate an administrator.
- Execution: The Veeam Endpoint Backup service executes attacker commands as NT AUTHORITY\SYSTEM.
Affected Systems
- Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier
- Shared workstations running Veeam Agent
- Administrator workstations running Veeam Agent
- Servers with local user access running Veeam Agent
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-32996 | Veeam Agent for Microsoft Windows | High | Local privilege escalation via unbound elevated session UIDs in gRPC named pipe. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe named pipe connections and file reads, but distinguishing malicious UID use is hard. |
| Network Visibility | None | Exploitation occurs entirely over local named pipes, generating no network traffic. |
| Detection Difficulty | Hard | Requires correlating named pipe connections with prior log file reads by the same user. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Standard users reading Svc.VeeamEndpointBackup.log followed by named pipe connections to ServiceConnectionPipe (T1006, T1068). | Sysmon EID 11, EID 17; EDR file and pipe events. | Privilege Escalation | Medium — Backup operators may legitimately read logs and interact with pipes. |
Required Log Sources
- Endpoint Detection and Response (EDR) telemetry
- Windows Security Event Logs
- Sysmon Event ID 17 (Named Pipe Connection)
- Sysmon Event ID 11 (File Creation)
Key Behavioral Indicators
- Non-admin process reading Svc.VeeamEndpointBackup.log
- Non-admin process connecting to \.\pipe\Veeam\VAW\ServiceConnectionPipe
- Process executing as SYSTEM spawned from Veeam service context
Control Gaps
- Standard signature-based AV will not detect named pipe abuse.
- File permission controls fail to prevent reading the log.
False Positive Assessment
Medium — Legitimate backup operators or Veeam service interactions may read logs and use named pipes, mimicking attack behavior.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Limit local administrator and backup operator privileges to required personnel.
- Audit and remove unnecessary local user accounts on Veeam Agent endpoints.
User Protection
- Confirm Veeam Agent service and tray components run fixed versions post-upgrade.
- Monitor shared workstations for unauthorized local user activity.
MITRE ATT&CK Mapping
Privilege Escalation
Stealth
Plain-Language Summary
A security flaw in Veeam backup software for Windows lets a low-privileged user take full control of the computer. The attacker abuses a communication channel used by the backup service to run commands with the highest system privileges. Organizations should update Veeam software to the latest version immediately, especially on computers used by multiple people or administrators.
Additional IOCs
- File Paths:
C:\ProgramData\eeam\Endpoint\Svc.VeeamEndpointBackup.log- World-readable log containing cached elevated session UIDs.
- cveCVE-2026-32996Local privilege escalation via unbound elevated session UIDs in gRPC named pipe.
- file_pathC:\ProgramData\eeam\Endpoint\Svc.VeeamEndpointBackup.logWorld-readable log containing cached elevated session UIDs.