Loading story…
Public proof-of-concept exploit code and technical details are available for CVE-2026-32996, a local privilege-escalation flaw in Veeam Agent for Microsoft Windows. A locally authenticated low-privileged user can abuse insecure handling of elevated session identifiers through the Veeam Endpoint Backup service’s local gRPC named pipe to execute commands as NT AUTHORITY\SYSTEM; reporting indicates active exploitation.
The issue affects version 13 builds through Veeam Agent 13.0.1.2067. Organizations should upgrade Veeam Backup & Replication to 13.0.2.29 or later, which deploys the fixed Windows agent build 13.0.3.1220. No official workaround is available, so remediation should be prioritized for shared systems and endpoints accessible to privileged or interactive users; where patching is delayed, local interactive access should be restricted.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
Public technical details and GitHub proof-of-concept exploit code were released for CVE-2026-32996, a local privilege-escalation flaw in Veeam Agent for Microsoft Windows. The PoC abuses exposed elevated session UIDs to allow a low-privileged local user to execute commands as NT AUTHORITY\SYSTEM on affected version 13 installations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcearcticwolf.com
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026
Veeam released security updates for multiple products after disclosing several vulnerabilities that affect enterprise backup and monitoring environments, including **Veeam Backup & Replication**, **Veeam ONE**, and **Veeam Service Provider Console**. The most severe issue, **`CVE-2026-32998`**, is a critical remote code execution flaw in Veeam Service Provider Console with a **CVSS score of 9.4**; Veeam said it is fixed in **version `9.2.1.33875`**. Canadian Centre for Cyber Security advisory **AV26-513** said affected versions include Veeam Backup & Replication 13 releases before **`13.0.2.29`**, Veeam ONE releases before **`13.0.2.6723`**, and Veeam Service Provider Console 9.2 releases before **`9.2.1.33875`**, and urged administrators to apply the vendor updates. Veeam also patched **`CVE-2026-32996`**, a high-severity local privilege escalation flaw in **Veeam Agent for Microsoft Windows** that could let a low-privileged local user gain administrative control, and **`CVE-2026-32997`**, an arbitrary file write issue affecting Linux-based backup servers running the **Veeam Software Appliance** that could allow an authenticated backup administrator to modify system files. For organizations unable to patch immediately, Veeam provided a workaround for the Service Provider Console bug by disabling the `AlarmManagement_ScriptExecution` setting in the local configuration JSON file, while older reporting on **Veeam ONE** underscores the continued security focus on Veeam’s management stack.
Jun 29, 2026
Veeam released a security advisory disclosing multiple vulnerabilities in its Veeam Backup & Replication and Veeam Agent for Microsoft Windows products. Two of the vulnerabilities, CVE-2025-48983 and CVE-2025-48984, were rated as critical with a CVSS score of 9.9, indicating a severe risk to affected systems. Both critical vulnerabilities reside in the Veeam Backup & Replication product and allow an authenticated domain user to execute arbitrary code on backup infrastructure hosts and the backup server, respectively. These flaws specifically impact Veeam Backup & Replication version 12.3.2.3617 and all earlier version 12 builds, but only on domain-joined backup servers. A third vulnerability, CVE-2025-48982, affects Veeam Agent for Microsoft Windows and allows for local privilege escalation if a system administrator is tricked into restoring a malicious file. This vulnerability impacts version 6.3.2.1205 and all earlier version 6 builds of the agent. The vendor has indicated that unsupported product versions have not been tested but are likely vulnerable and should be considered at risk. The vulnerabilities were disclosed on October 14, 2025, and security advisories were published the following day to alert users and administrators. CERT-EU and other security organizations have strongly recommended that organizations update affected software immediately to mitigate the risk of exploitation. In addition to patching, following Veeam's implementation best practices is advised to further reduce exposure. The vulnerabilities require an authenticated domain user for exploitation, which means that attackers would need valid credentials or access to a compromised account within the target environment. The potential impact of successful exploitation includes full remote code execution on critical backup infrastructure, which could lead to data theft, ransomware deployment, or destruction of backup data. The disclosure has raised concerns in the security community due to the critical nature of backup systems in organizational resilience and recovery. Security advisories have emphasized the urgency of remediation, given the high CVSS scores and the potential for significant operational disruption. Organizations are also advised to review their backup server configurations and restrict access to trusted users only. The vendor has provided detailed guidance and best practices for hardening Veeam deployments, including recommendations for both workgroup and domain-joined environments. The vulnerabilities highlight the ongoing risks associated with backup infrastructure and the importance of timely patch management. Security teams are urged to monitor for signs of exploitation and to ensure that all backup-related systems are included in vulnerability management programs. The incident underscores the need for layered security controls and regular review of privileged access within enterprise environments.
Jun 29, 2026