CVE-2026-32997: Veeam Backup Privilege Escalation Flaw

CVE-2026-32997 Overview

CVE-2026-32997 is an arbitrary file write vulnerability in Veeam Backup & Replication on Linux-based servers. An authenticated user holding the Backup Administrator role can write files to arbitrary locations on the underlying operating system. The issue is classified under [CWE-36] Absolute Path Traversal. Veeam published guidance in the Veeam Knowledge Base Article.

The vulnerability requires authentication with elevated application privileges but allows attackers to influence files outside the intended directory scope. Successful exploitation can compromise the confidentiality, integrity, and availability of the Veeam Backup & Replication host.

Critical Impact
An authenticated Backup Administrator can write arbitrary files on the Linux host, enabling tampering with system binaries, configuration files, or scheduled tasks to escalate privileges or persist on the backup server.

Affected Products

Veeam Backup & Replication (Linux-based deployments)
See the Veeam Knowledge Base Article for affected versions
Veeam-managed Linux backup infrastructure components

Discovery Timeline

2026-05-28 - CVE-2026-32997 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-32997

Vulnerability Analysis

The flaw allows a user with the Backup Administrator role to supply file paths that are not properly constrained to an expected directory. Because the affected code path on Linux honors absolute or traversal-style paths, the application writes attacker-controlled content to locations chosen by the user. The CWE-36 classification indicates the software resolves absolute paths supplied as input without enforcing a safe base directory.

An attacker with Backup Administrator credentials can overwrite configuration files, drop scripts into directories used by cron, systemd, or shell initialization, or replace binaries the Veeam service later executes. This converts an application-level privilege into operating system control of the backup server. Because backup servers store credentials and access production data, compromise of the host has downstream impact on the protected estate.

Root Cause

The root cause is improper validation of file path input in a privileged Veeam Backup & Replication code path on Linux. The application accepts paths from an authenticated administrator without canonicalizing them against an allow-listed directory, satisfying the conditions for [CWE-36] Absolute Path Traversal.

Attack Vector

The attack is network-reachable but requires high privileges, specifically the Backup Administrator role. An attacker who has compromised or been granted that role sends crafted input to a function that writes a file, supplying an absolute path outside the intended directory. No user interaction is required. Refer to the Veeam Knowledge Base Article for the affected operations and parameters.

Detection Methods for CVE-2026-32997

Indicators of Compromise

Unexpected files appearing under sensitive Linux paths such as /etc/, /usr/local/bin/, /root/, or user ~/.ssh/ directories on the Veeam Backup & Replication server
Modifications to system service units, cron jobs, or shell profile files with timestamps matching Veeam process activity
File writes performed by the Veeam service account to paths outside its normal working directories

Detection Strategies

Enable filesystem audit rules via auditd on the Linux backup host to record writes by the Veeam service user to directories outside its expected scope
Correlate Veeam application audit logs of Backup Administrator actions with operating system file creation events on the same host
Alert on creation of executable files or service unit files on the Veeam server outside change windows

Monitoring Recommendations

Monitor logons and role assignments for the Backup Administrator role and alert on new or unexpected grants
Forward Veeam Backup & Replication and Linux audit logs to a centralized SIEM for correlation and retention
Baseline the file inventory of the Veeam server and review deviations on a recurring schedule

How to Mitigate CVE-2026-32997

Immediate Actions Required

Apply the fix described in the Veeam Knowledge Base Article to all Linux-based Veeam Backup & Replication servers
Review and reduce the number of accounts assigned the Backup Administrator role to the minimum required
Rotate credentials and secrets stored on or accessible from the Veeam Backup & Replication server after patching

Patch Information

Veeam has published remediation guidance in the Veeam Knowledge Base Article. Administrators should consult that advisory for fixed versions and upgrade instructions specific to their deployment.

Workarounds

Restrict network access to the Veeam Backup & Replication management interfaces to trusted administrative hosts only
Enforce multi-factor authentication for accounts that hold the Backup Administrator role
Isolate the Linux backup server on a dedicated management network segment and prohibit interactive logins by non-administrators

bash

# Configuration example
# Audit file writes by the Veeam service user on Linux
auditctl -a always,exit -F arch=b64 -S openat -F exit=-EACCES -k veeam_denied_write
auditctl -w /etc -p wa -k veeam_etc_write
auditctl -w /usr/local/bin -p wa -k veeam_bin_write
# Review events
ausearch -k veeam_etc_write -ts recent