CVE-2026-32996: Veeam Agent Privilege Escalation Flaw

CVE-2026-32996 Overview

CVE-2026-32996 is a local privilege escalation vulnerability affecting Veeam Agent for Microsoft Windows. The flaw is classified under [CWE-532] (Insertion of Sensitive Information into Log File), indicating that the product writes sensitive data to log files accessible to lower-privileged users. A local authenticated attacker can read these logs to recover credentials or other secrets, then leverage them to elevate privileges on the host.

Critical Impact
A low-privileged local user can escalate to higher privileges by harvesting sensitive information exposed in Veeam Agent log files, compromising the confidentiality, integrity, and availability of the affected Windows system.

Affected Products

Veeam Agent for Microsoft Windows
Refer to the Veeam Knowledge Base Article for the complete list of affected versions
Windows endpoints running vulnerable Veeam Agent installations

Discovery Timeline

2026-05-28 - CVE-2026-32996 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-32996

Vulnerability Analysis

The vulnerability arises from Veeam Agent for Microsoft Windows writing sensitive information into log files. Under [CWE-532], an application stores data such as credentials, tokens, or configuration secrets in log records that lack adequate access restrictions. A local attacker who can read these logs gains material that enables privilege escalation against the host or its protected workloads.

Exploitation requires local access with low privileges and some user interaction or environmental preconditions. No network access is required, and no elevated rights are needed to begin the attack chain. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected system.

Root Cause

The root cause is improper handling of sensitive data during log generation. The Veeam Agent process emits diagnostic or operational records that include secrets without redaction or restricted access controls. Because backup agents typically run with SYSTEM privileges and interact with credential stores, log entries can expose authentication material that is otherwise protected.

Attack Vector

The attack vector is local. An authenticated user on the Windows host reads Veeam Agent log files from the file system. The attacker parses the logs for credentials, session identifiers, or other privileged data, then reuses that material to execute actions in the context of a higher-privileged account. See the Veeam Knowledge Base Article for vendor-confirmed technical details.

Detection Methods for CVE-2026-32996

Indicators of Compromise

Unexpected read access to Veeam Agent log directories by non-administrative user accounts
File copy or archival operations targeting Veeam log paths from interactive user sessions
Process executions spawning from accounts that read Veeam log files shortly before privilege changes

Detection Strategies

Monitor file access events on Veeam Agent log directories and alert on reads by accounts outside the backup administration group
Correlate log-file access with subsequent authentication events that use the same credentials across the host
Hunt for command-line tools such as findstr, Select-String, or type reading Veeam log paths

Monitoring Recommendations

Enable Windows object access auditing (Event ID 4663) for Veeam Agent log file paths
Forward endpoint telemetry to a centralized analytics platform to baseline normal Veeam log access patterns
Review local group membership changes and token elevation events on hosts running Veeam Agent

How to Mitigate CVE-2026-32996

Immediate Actions Required

Apply the patched version of Veeam Agent for Microsoft Windows as identified in the Veeam Knowledge Base Article
Inventory all endpoints running Veeam Agent and prioritize patching for systems with interactive non-administrative users
Rotate any credentials that may have been written to Veeam Agent logs prior to remediation

Patch Information

Veeam has published remediation guidance and fixed builds. Consult the Veeam Knowledge Base Article for the exact patched versions and upgrade procedures. Apply the update across all Windows hosts running the Veeam Agent.

Workarounds

Restrict NTFS permissions on Veeam Agent log directories so that only the SYSTEM account and backup administrators can read them
Purge existing log files that may contain sensitive information after applying the patch
Limit interactive logon rights on servers running Veeam Agent to reduce local attacker exposure

bash

# Restrict access to Veeam Agent log directory (run as Administrator)
icacls "C:\ProgramData\Veeam\Backup" /inheritance:r
icacls "C:\ProgramData\Veeam\Backup" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\ProgramData\Veeam\Backup" /remove "Users" "Authenticated Users"