Posted on

Veeam Agent for Windows CVE-2026-32996 – Active Local Privilege Escalation to SYSTEM

Threat Overview

Arctic Wolf reported active exploitation of CVE-2026-32996, a Veeam Agent for Microsoft Windows local privilege-escalation vulnerability. The Veeam Endpoint Backup service handles elevated client sessions over the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe. An elevated administrator principal is cached against a client-controlled session UID that is not bound to the requesting user or connection. Elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which standard users can read. An attacker with local low-privileged access can recover a valid UID and abuse the service to execute commands as NT AUTHORITY\SYSTEM. Public proof-of-concept code exists.

References

Impacted Systems

Veeam Agent for Microsoft Windows in Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds. Exploitation requires local low-privileged access to the Windows endpoint. Veeam fixed CVE-2026-32996 beginning with Veeam Backup & Replication 13.0.2.29.

Why this matters

Backup agents and infrastructure are high-value ransomware targets. Once an attacker has a low-privileged foothold, this flaw provides a path to SYSTEM, enabling credential access, security-control tampering, persistence, and attacks against recovery infrastructure.

Exploitation Status

Arctic Wolf reports active exploitation. Veeam fixed the vulnerability in June 2026; public technical details and proof-of-concept code materially increase exploitation risk.

What this hunt looks for

Affected Veeam software versions, references to the Veeam service pipe and log, Veeam service child processes, SYSTEM shells, service creation, credential tooling, and new outbound destinations from Veeam hosts.

Required logs

Defender XDR DeviceTvmSoftwareInventory, DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents, plus Windows SecurityEvent where available.

First Pass – Veeam Agent Version Inventory

DeviceTvmSoftwareInventory
| where SoftwareVendor has "Veeam" or SoftwareName has "Veeam Agent"
| project DeviceName,SoftwareVendor,SoftwareName,SoftwareVersion,EndOfSupportStatus
| order by DeviceName asc

Processes Referencing Veeam ServiceConnectionPipe

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has @"Veeam\VAW\ServiceConnectionPipe" or ProcessCommandLine has "Svc.VeeamEndpointBackup.log"
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine,SHA256
| order by Timestamp desc

Veeam Service Spawning Command Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessCommandLine has_any ("Veeam","VeeamEndpointBackup")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

SYSTEM Shells With Veeam Ancestry

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName =~ "SYSTEM"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
| where InitiatingProcessCommandLine has_any ("Veeam","VeeamEndpointBackup")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

New Services After Veeam Activity

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 7045
| project TimeGenerated,Computer,Account,Activity,EventData
| order by TimeGenerated desc

Veeam-Related File Activity

DeviceFileEvents
| where Timestamp >= ago(30d)
| where FolderPath has @"\ProgramData\Veeam\Endpoint"
| where FileName has_any ("Svc.VeeamEndpointBackup.log","VeeamEndpointBackup")
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Post-Escalation Credential Tooling

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where AccountName =~ "SYSTEM"
| where ProcessCommandLine has_any ("sekurlsa","lsass","comsvcs.dll","reg save hklm\sam","ntdsutil","procdump")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName
| order by Timestamp desc

Veeam Host New Outbound Destinations

let VeeamDevices=DeviceTvmSoftwareInventory
| where SoftwareVendor has "Veeam" or SoftwareName has "Veeam Agent"
| distinct DeviceId;
let Known=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(2d))
| where DeviceId in (VeeamDevices)
| summarize by DeviceId,RemoteIP,RemoteUrl;
DeviceNetworkEvents
| where Timestamp >= ago(2d)
| where DeviceId in (VeeamDevices)
| join kind=leftanti Known on DeviceId,RemoteIP,RemoteUrl
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Detection Notes

Version inventory is the highest-value first pass. Exploitation requires an existing local foothold, so suspicious Veeam child processes or SYSTEM execution should be correlated with initial-access activity on the same host. DeviceTvmSoftwareInventory requires Defender software inventory. File telemetry may not record every read of the Veeam log file.

Leave a comment