Spots 
CVE-2026-32996 is a high-severity local privilege escalation in Veeam Agent for Microsoft Windows, rated 7.3 under CVSS v4. Researchers report active exploitation in the wild, and public proof-of-concept code has been disclosed, sharply lowering the effort required to attack unpatched endpoints. Mechanism and exploitation conditions
The Veeam Endpoint Backup service caches an elevated administrator principal against a client-controlled session UID while handling sessions over the local gRPC named pipe \.\pipe\Veeam\VAW\ServiceConnectionPipe. The UID is not bound to the requesting user or connection, so another local process can reuse it. Elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which standard users can read. Reading a valid UID and replaying it yields command execution as SYSTEM. The public proof-of-concept runs commands and captures output to a file.
Successful exploitation grants NT AUTHORITY\SYSTEM, allowing defense evasion, persistence, credential theft, and lateral movement. Because the vulnerable component is a backup agent, attackers may also reach backup repositories and recovery data. Affected products and versions Veeam Agent for Microsoft Windows 13.0.1.2067 All earlier version 13 builds Remediation and mitigation
Patch to Veeam Backup & Replication 13.0.2.29 or later, which updates the agent to build 13.0.3.1220. If that is not immediately possible, restrict interactive local access on affected endpoints, limit local administrator and backup operator privileges, and monitor for anomalous SYSTEM-level activity. Prioritize shared servers and administrator workstations. SecurityOnline: Actively Exploited Veeam Agent Vulnerability PoC Disclosed Veeam security advisories (vendor) For further actions, you may consider blocking this person and/or reporting abuse
CVE-2026-32996 is a high-severity local privilege escalation in Veeam Agent for Microsoft Windows, rated 7.3 under CVSS v4.