Veeam Agent for Windows Local Privilege Escalation
Local privilege escalation in Veeam Agent for Microsoft Windows gives local attackers SYSTEM-level access. CVSS 7.3 high, confirmed exploited in the wild.
- Vendor
- Veeam
- Product
- Veeam Agent for Microsoft Windows
- CVSS
- 7.3
- EPSS (exploit probability)
- 0.3%
- Status
- exploited-in-wild
- Published
Is CVE-2026-32996 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-32996 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored November 8, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-32996 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-32996 is a local privilege escalation in Veeam Agent for Microsoft Windows, rated CVSS 7.3 high. An attacker with existing local access can exploit the flaw to obtain SYSTEM-level control of the endpoint.
Arctic Wolf researchers identified this vulnerability as actively exploited in the wild as of September 2026. Veeam has released a patch; consult the NVD record for current version guidance.
The local-access prerequisite raises the CVSS score’s effective exploitability bar, but backup infrastructure warrants particular care: Veeam Agent hosts typically hold backup credentials, broad file-system access, and paths to other network segments. SYSTEM on such a host is a meaningful attacker position.
Other Veeam CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 90.4% | |
| CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerabilityransomware use | [ HIGH ] | 7.5 | 80.6% | |
| CVE-2022-26501 Veeam Backup & Replication Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 4.1% | |
| CVE-2022-26500 Veeam Backup & Replication Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.8 | 5.8% |
