Critical Local Privilege Escalation in Veeam Agent for Windows (CVE‑2026‑32996)
What Happened – A public proof‑of‑concept released on 14 Sept 2026 demonstrates that Veeam Agent for Microsoft Windows (up to 13.0.1.2067) allows any local user to obtain NT AUTHORITY\SYSTEM privileges. The flaw resides in the Endpoint Backup service’s handling of elevated client sessions over a local gRPC named pipe, where a user‑controlled session ID is trusted without verification.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must verify that privileged services enforce strong session authentication and do not expose elevation mechanisms to non‑admin accounts.
- The vulnerability highlights the need for real‑time monitoring of privileged process activity and immutable audit logs to prove that escalation paths are blocked.
- Addressing this scenario aligns with Verisq’s ACCESS_CONTROLS capability, enabling organizations to demonstrate defensible evidence of proper least‑privilege enforcement.
Who Is Affected – Enterprises that deploy Veeam Agent on shared Windows workstations, including finance, healthcare, and SaaS providers that rely on endpoint backup.
Recommended Actions
- Inventory all Windows endpoints running Veeam Agent and verify the version is newer than 13.0.1.2067.
- Apply the vendor‑released patch immediately; if unavailable, disable the Veeam Endpoint Backup service on shared machines.
- Enforce least‑privilege policies: restrict local user rights, block read access to
Svc.VeeamEndpointBackup.log, and monitor for anomalous service‑level activity. - Capture and retain logs of the backup service’s pipe interactions as part of your continuous audit evidence.
Technical Notes – The exploit leverages a local privilege escalation (LPE) bug (CVE‑2026‑32996) in the Veeam Endpoint Backup service’s gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe. The service caches an elevated administrator principal against a client‑controlled session UID that is not bound to the requesting user. The PoC reads the log file C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, copies a valid UID, and executes commands as SYSTEM. Source: https://securityaffairs.com/199532/security/public-poc-exposes-critical-veeam-agent-privilege-escalation.html