UPDATE: Active Exploitation CVE-2026-32996 of Veeam Agent - Arctic Wolf
CVE-2026-32996 is a local privilege escalation flaw in Veeam Agent for Windows allowing low-privileged users to gain SYSTEM via a gRPC named pipe. A local privilege escalation vulnerability in Veeam Agent for Windows allows low-privileged users to execute commands as SYSTEM. Attackers exploit unbound elevated session UIDs cached over a gRPC named pipe.
Detection / Hunteropenrouter
Immediate Actions
- Upgrade Veeam Backup & Replication to 13.0.2.29 or later.
- Restrict local and interactive access to affected systems.
Key Takeaways
- Public PoC exploit code released on 14 September 2026.
- Affects Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier.
- Exploitation abuses cached elevated session UIDs over gRPC named pipe.
- Standard users can read Svc.VeeamEndpointBackup.log to steal session UIDs.
- Fixed in Veeam Agent build 13.0.3.1220 via Veeam B&R 13.0.2.29.
Attack Chain
- Initial Access: Attacker obtains local low-privileged access to endpoint running Veeam Agent.
- Discovery: Attacker reads Svc.VeeamEndpointBackup.log to find cached elevated session UID.
- Exploitation: Attacker sends gRPC request to named pipe using stolen UID.
- Execution: Veeam Endpoint Backup service executes attacker commands as SYSTEM.
Affected Systems
- Veeam Agent for Microsoft Windows version 13.0.1.2067
- Veeam Agent for Microsoft Windows earlier version 13 builds
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-32996 | Veeam Agent for Microsoft Windows | High | Local privilege escalation allowing low-privileged users to elevate to SYSTEM. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect command execution by SYSTEM from standard user contexts and file reads. |
| Network Visibility | None | Exploitation occurs entirely over local gRPC named pipes. |
| Detection Difficulty | Moderate | Requires correlating standard user file reads with subsequent SYSTEM process executions. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Standard user processes reading Svc.VeeamEndpointBackup.log followed by SYSTEM process creation (T1068). | Process creation, file access logs. | Privilege Escalation | Low — specific log file read by standard user is unusual. |
Required Log Sources
- Process creation logs (Event ID 4688)
- File access logs
- Veeam Endpoint Backup service logs
Key Behavioral Indicators
- Standard user reading Svc.VeeamEndpointBackup.log
- Unexpected SYSTEM processes spawned via Veeam Endpoint Backup service
Control Gaps
- Application logs lacking security auditing for named pipe sessions.
False Positive Assessment
Low — Specific log file access by standard users and subsequent SYSTEM execution is highly anomalous.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Limit interactive local access to endpoints running Veeam Agent.
- Restrict local administrator and backup operator privileges.
User Protection
- Prioritize patching systems used by administrators and backup operators.
- Confirm Veeam Agent service and tray components run fixed versions.
MITRE ATT&CK Mapping
Privilege Escalation
Discovery
Plain-Language Summary
A flaw in Veeam backup software for Windows lets a standard user trick the software into running commands with full system privileges. Anyone with basic access to a computer running affected versions can exploit this. Update Veeam Backup & Replication to version 13.0.2.29 or later immediately.
Additional IOCs
- File Paths:
C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log- Path to log file leaking elevated session UIDs.
- Command Lines:
- Purpose: PoC executes whoami and writes output to a file | Tools:
whoami| Stage: Execution |whoami > <output_file>
- Purpose: PoC executes whoami and writes output to a file | Tools:
- cveCVE-2026-32996Local privilege escalation allowing low-privileged users to elevate to SYSTEM.
- filenameSvc.VeeamEndpointBackup.logLog file readable by standard users containing elevated session UIDs.
- file_pathC:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.logPath to log file leaking elevated session UIDs.