VEEAM Agent for Microsoft Windows vulnerability CVE-2026-32996 is reportedly being exploited in the wild, with public technical details and proof-of-concept code now available. Arctic Wolf researchers confirmed the active exploitation, according to the report. Rated 7.3 (High) under CVSSv4, the flaw enables a locally authenticated, low-privileged user to elevate privileges to NT AUTHORITY\SYSTEM, potentially taking complete control of an affected Windows endpoint. The report lists Veeam Agent for Microsoft Windows version 13.0.1.2067 and all earlier version 13 builds as affected.
The vulnerability lies in the Endpoint Backup service’s handling of elevated client sessions over the local `\\.\pipe\Veeam\VAW\ServiceConnectionPipe` gRPC named pipe. The service associates an elevated administrator session with a client-controlled session UID that is not tied to the requesting user or connection. These elevated UIDs are recorded in `C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log`, which standard users can read.
An attacker can obtain a valid UID and use it to run commands as SYSTEM; a public GitHub proof of concept demonstrates command execution and writing the output to a file.
Veeam advises upgrading to Veeam Backup & Replication version 13.0.2.29 or later, which updates the agent to secure build 13.0.3.1220. Administrators should consult Veeam’s security advisory for download instructions and prioritise shared servers and administrator workstations. Where immediate patching is not possible, the report recommends restricting interactive local access and limiting local administrator and backup operator privileges.