CVE-2026-32997: A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server

Synopsis

An arbitrary file write vulnerability affects Linux-based Veeam Backup and Replication servers at version 13.0.1 and earlier. An attacker must authenticate with a Backup Administrator account and reach the server over the network, but once they do they can write arbitrary files to the underlying Linux host. Successful exploitation gives the attacker full control over file contents on the server, which can be leveraged to overwrite critical system files, plant malicious binaries, or achieve remote code execution. No patched version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Veeam Backup and Replication server over the network to deliver the exploit.

• AuthenticationRequired

  A valid account holding the Backup Administrator role is required; unauthenticated access is not sufficient.

• Victim interactionNot required

  No action from any other user or administrator is needed to complete the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors.

Blast Radius

• The attacker can write arbitrary files anywhere on the Linux host, enabling overwrite of system binaries, configuration files, or SSH authorized keys.
• With control over file contents, the attacker can plant a malicious executable or cron entry and escalate to persistent remote code execution on the backup server.
• Because backup servers typically hold credentials and data for many connected workloads, a compromised server exposes the confidentiality and integrity of all backup data stored on or accessible from that host.
• The VA:H token indicates the attacker can also crash or destabilize the service, causing backup operations to fail and leaving protected workloads without a recent recovery point.