CVE-2026-32996: This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation

Synopsis

A local privilege escalation vulnerability affects Veeam Agent for Microsoft Windows (Veeam Backup and Replication version 13.0.1 and earlier). An attacker with a low-privilege account on the host can exploit this without any network access or victim interaction, though certain preconditions must align. Successful exploitation gives the attacker full read, write, and availability impact on the local system, including the ability to take control of the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to reach the vulnerable code path.

• Victim interactionNot required

  The exploit runs entirely under the attacker's control with no action required from another user.

• Attack complexityDetail

  The exploit is generally reliable but requires specific preconditions (AT:P) to be in place, such as a particular system state or configuration, rather than being unconditionally triggerable.

Blast Radius

• Reads sensitive data from the local system, including credentials, backup metadata, and configuration files accessible to the elevated process.
• Modifies or deletes local files and system configuration, including backup job definitions and stored recovery points managed by Veeam Agent.
• Disrupts availability of the local Veeam Agent service and any scheduled backup or restore operations running on the host.
• Gains full control of the local Windows host, enabling persistence, lateral movement staging, or destruction of backup data.