CVE-2026-32996Active Exploitation

HIGHCVSS 7.3 · HIGH

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://www.veeam.com/kb4852

Weakness type (CWE)

CWE-532

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 15 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
28 mentions across 10 observed days

What's happening

Active exploitation reported across 15 signals
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 13 signals
Technical details provided in 22 signals
Disclosure: 3 classified signals
Peaked 4d ago at 10 mentions (2026-09-22); latest day: 1
28 total mentions across 10 days

Deep dive

Activity timeline28 mentions / 10d

Signal classification6 categories

Active Exploitation

1450.0%

Patch

414.3%

Disclosure

310.7%

Exploit

310.7%

PoC

310.7%

False Positive

13.6%

Referenced assets20 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	1	Patch1
2026-05-29	2	Active Exploitation1Patch1
2026-06-04	1	Disclosure1
2026-06-10	1	Disclosure1
2026-09-21	1	Exploit1
2026-09-22	10	Active Exploitation7False Positive1Patch1PoC1
2026-09-23	5	Active Exploitation3Disclosure1Patch1
2026-09-24	5	Active Exploitation2Exploit1PoC2
2026-09-25	1	Exploit1
2026-09-29	1	Active Exploitation1

Full discourse20 posts

elhacker.NET@elhackernet19d
Active Exploitation
Vulnerabilidad de Veeam Agent explotado para obtener privilegios SYSTEM en Windows Se ha detectado una falla crítica de escalada de privilegios locales en Veeam Agent para Microsoft Windows (identificada como CVE-2026-32996 https://blog.elhacker.net/2026/09/vulnerabilidad-de-veeam-agent-explotado.html
Post summary
The tweet reports that CVE‑2026‑32996, a critical local privilege escalation in Veeam Agent for Windows, has been actively exploited to achieve SYSTEM privileges.
020066195.7K
142.4K followersView on X
IT-Connect.fr@ITConnect_fr17d
Exploit
⚠️ Veeam Agent pour Windows : la faille CVE-2026-32996 offre les privilèges SYSTEM, un exploit est public Tous les détails sur IT-Connect : - https://www.it-connect.fr/veeam-agent-windows-faille-cve-2026-32996-privileges-system/ #veeam #infosec #cybersecurite https://t.co/DUgOea3aAC
Post summary
The tweet reports on CVE-2026-32996 affecting Veeam Agent for Windows, highlighting SYSTEM privilege escalation and asserting that a public exploit is available, linked to a news analysis rather than direct exploit code.
0601641.3K
11.7K followersView on X
yousukezan@yousukezan19d
PoC
Veeam Agent for Microsoft Windowsにおける重要なローカル権限昇格の脆弱性（CVE-2026-32996）のPoCエクスプロイトコードが公開された。低権限のローカルユーザーが影響を受けるWindowsデバイス上でNT AUTHORITY\SYSTEM権限でコマンドを実行可能。 https://cybersecuritynews.com/veeam-agent-flaw-exploited/
Post summary
The tweet reports the public release of PoC exploit code for the Veeam Agent for Microsoft Windows local privilege escalation vulnerability (CVE-2026-32996), detailing the ability for low-privileged users to execute commands as SYSTEM.
000541.5K
16.5K followersView on X
dbugs@ptdbugs21d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-32996 PT ID: PT-2026-44174 Vendor: Veeam Product: Backup and Replication Description: This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. References: • https://dbu.gs/vulnerability/PT-2026-44174 • https://github.com/suce0155/cve-2026-32996
Post summary
A PoC/exploit has been discovered for CVE-2026-32996, a local privilege escalation vulnerability in Veeam Agent for Microsoft Windows, with a link to a GitHub repository containing the exploit code.
000441.2K
3.7K followersView on X
Autumn Good@autumn_good_35137d
Patch
サイレント修正していた？『These vulnerabilities were fixed starting with the following build: Veeam Backup & Replication 13.0.2.29』 CVE-2026-32996 CVE-2026-32997 KB4852: Vulnerabilities Resolved in Veeam Backup & Replication 13.0.2 https://www.veeam.com/kb4852
Post summary
The text reports that CVE-2026-32996 and CVE-2026-32997 have been patched in Veeam Backup & Replication build 13.0.2.29, as detailed in the vendor KB reference.
01011541
6.9K followersView on X
zoomeyebot@zoomeyebot19d
Active Exploitation
🚨 Actively Exploited Veeam Agent Vulnerability (CVE-2026-32996) Grants SYSTEM Privileges; Public PoC Released Critical Vulnerability Alert! Veeam Agent for Microsoft Windows (Veeam Backup & Replication 13) is affected by CVE-2026-32996. 🔍 Identify Targets via ZoomEye: Search Dork: ssl="Veeam" Exposure: 99.6k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=c3NsPSJWZWVhbSI%3D #Veeam #CVE202632996 #PrivilegeEscalation #RCE #CyberSecurity #ZoomEye
Post summary
The alert reports that CVE-2026-32996 in Veeam Agent is actively exploited, granting SYSTEM privileges, and notes that a public PoC has been released.
0002074
24 followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX19d
Active Exploitation
🚨 VEEAM FLAW IS BEING EXPLOITED TO REACH WINDOWS SYSTEM PRIVILEGES Attackers are exploiting CVE-2026-32996 in Veeam Agent for Microsoft Windows. The weakness can let a local attacker abuse Veeam's privileged service handling and escalate to NT AUTHORITY\SYSTEM. Translation: Initial foothold ↓ Veeam session abuse ↓ Privilege escalation ↓ SYSTEM Backup software is high-value infrastructure. It often runs with powerful privileges, touches sensitive data and becomes especially important during ransomware recovery. That's exactly why attackers care about it. CyberSignal insight: Anything trusted with recovery is also worth attacking. Source: Veeam · CISA reporting · The Hacker News #Cybersecurity
Post summary
Attackers are actively exploiting a Veeam Agent privilege escalation flaw (CVE‑2026‑32996) to obtain SYSTEM rights on Windows, highlighting the high value of backup software as an attack target.
0101069
230 followersView on X
Daily CyberSecurity@Daily_CyberSec20d
Active Exploitation
A critical exploited Veeam Agent vulnerability (CVE-2026-32996) is under active attack. Public PoC exploit code has been disclosed. Update systems now. #Veeam #CVE202632996 #Cybersecurity #Vulnerability #Infosec https://securityonline.info/actively-exploited-veeam-agent-vulnerability-poc/
Post summary
The tweet alerts that CVE-2026-32996 in Veeam Agent is being actively exploited in the wild, with public PoC code available, and urges immediate system updates.
00010436
13.0K followersView on X
CCB Alert@CCBalert135d
Patch
Warning: High severity #vulnerabilities in #Veeam Backup & Replication allow local privilege escalation #LPE and arbitrary file writes. #CVE-2026-32997 CVSS(4.0): 8.6 | #CVE-2026-32996 CVSS(4.0): 7.3. Read the advisory at https://www.veeam.com/kb4852 and #Patch #Patch #Patch
Post summary
The tweet highlights two high‑severity local privilege escalation vulnerabilities in Veeam Backup & Replication, provides CVSS scores, and directs users to a Veeam advisory for patching.
01000257
7.2K followersView on X
iototsecnews@iototsecnews13d
Active Exploitation
Veeam Agent の脆弱性 CVE-2026-32996：Windows の SYSTEM 権限を侵害する PoC が登場 https://iototsecnews.jp/2026/09/22/veeam-agent-flaw-actively-exploited-to-gain-system-privileges-on-windows/ この記事は、Veeam Agent for Microsoft Windows におけるローカル権限昇格の脆弱性 CVE-2026-32996 を解説するものです。gRPC 名前付きパイプ処理時のセッション識別子の紐付け不備とログファイルからの ID 漏洩が原因であり、低特権ユーザーによる最高権限での任意のコマンド実行／セキュリティ機能の無効化／内部ネットワークでの横展開などの被害につながる恐れがあります。パッチ適用済みのビルド 13.0.3.1220 以上のバージョンへの更新／影響を受ける端末の特定／対話型アクセスの制御／SYSTEM 権限での不審なプロセスの監視が対応策として求められます。 #CVE202632996 #PoC #Veeam #Vulnerability
Post summary
The text discusses CVE-2026-32996 in Veeam Agent for Windows, highlighting active exploitation to gain SYSTEM privileges using a gRPC session identifier flaw. It includes details of a PoC, mitigation via patching, and technical vulnerability specifics.
00000171
518 followersView on X
Rene Robichaud@ReneRobichaud17d
Exploit
Veeam Agent pour Windows : la faille CVE-2026-32996 offre les privilèges SYSTEM, un exploit est public https://www.it-connect.fr/veeam-agent-windows-faille-cve-2026-32996-privileges-system/
Post summary
The article reports that CVE‑2026‑32996 in Veeam Agent for Windows can be leveraged to obtain SYSTEM privileges and notes that a public exploit for the flaw is available. No patch, workaround, or active exploitation details are provided.
0000054
3.8K followersView on X
CeptBiro@CeptBiro17d
PoC
Veeam Agent pour Windows : la faille CVE-2026-32996 offre les privilèges SYSTEM, un exploit est public https://www.it-connect.fr/veeam-agent-windows-faille-cve-2026-32996-privileges-system/
Post summary
The tweet discloses CVE-2026-32996 in Veeam Agent for Windows, a privilege escalation flaw granting SYSTEM access, and highlights that a public exploit is available.
0000036
439 followersView on X
thibault@akril17d
PoC
[IT-Connect] - Veeam Agent pour Windows : la faille CVE-2026-32996 offre les privilèges SYSTEM, un exploit est public - https://www.it-connect.fr/veeam-agent-windows-faille-cve-2026-32996-privileges-system/ 👌😁
Post summary
The text announces the existence of a public exploit for CVE-2026-32996 in Veeam Agent for Windows, highlighting a privilege escalation vulnerability that grants SYSTEM privileges. The primary focus is on confirming the availability of a PoC.
0000045
693 followersView on X
BT Haberler@BTHaberler17d
Active Exploitation
Çin Bağlantılı Saldırganlar, Zyxel Switch Açığını Kullanarak 48 Ülkede 996 Cihazdan Veri Çaldı! Zyxel GS1900 serisi ağ anahtarlarındaki CVE-2026-7273 (CVSS 8.8), kimlik doğrulaması olmayan bir saldırganın değiştirilmiş bir HTTP isteğiyle işletim sistemi komutu çalıştırmasına izin veriyor; Çin kökenli olduğu değerlendirilen tehdit aktörleri Ağustos 2026'dan beri bu açığı kullanarak 48 ülkede 996 anahtardan yapılandırma, kök kimlik bilgisi ve ağ verisi çaldı. • Aynı gün aktif istismarı doğrulanan ikinci bir açık, Veeam Agent for Windows'taki CVE-2026-32996 (CVSS 7.3), yerel erişimi olan bir saldırganın SYSTEM seviyesinde tam kontrol kazanmasına izin veriyor. • Federal kurumlar için her iki açığın da 24 Eylül'e kadar yamalanması zorunlu tutuldu. Ucuz, ofis/küçük işletme sınıfı ağ anahtarlarının bile 48 ülkede sistematik olarak taranıp istismar edilebilmesi, saldırganların artık sadece büyük kurumsal hedeflere değil, "önemsiz" görülen küçük ölçekli ağ donanımlarına da endüstriyel ölçekte yatırım yaptığını gösteriyor. #SiberGüvenlik #Zyxel #Veeam
Post summary
Chinese threat actors have been actively exploiting CVE-2026-7273 in Zyxel switches to steal data from 996 devices in 48 countries, and CVE-2026-32996 in Veeam Agent is also actively exploited; federal agencies are required to patch both by September 24.
0000043
43 followersView on X
Swif@swif_ai18d
Active Exploitation
Veeam Agent for Windows CVE-2026-32996, now exploited: elevated session IDs land in a log standard users can read, and reusing one runs commands as SYSTEM. Backup agents are privileged code; inventory and patch them. https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html
Post summary
The post reports that CVE-2026-32996 in Veeam Agent for Windows is actively exploited in the wild, detailing the privilege escalation technique involving readable session IDs, and urges immediate patching.
0000046
67 followersView on X
kotaro@サイバーセキュリティ情報発信@ngsk_ciso18d
Active Exploitation
Veeamが、Windows向けバックアップAgent（Veeam Agent for Microsoft Windows）に、その端末にログインできる一般ユーザーからSYSTEM権限まで上げられる穴（CVE-2026-32996、CVSS 7.3）があると公表した。対象は Agent を含む Veeam Backup & Replication 13.0.1.2067以前の13系。遠隔からいきなり入る穴ではなく、すでにそのPCに入れる前提のローカル権限昇格。直す版は Veeam Backup & Replication 13.0.2.29以上（同梱の Agent は 13.0.3.1220系）。セキュリティ会社Arctic Wolfは、実攻撃での悪用を確認したと公表している。Veeam公式KB自体は悪用の有無を書いていない。米CISAのKnown Exploited Vulnerabilities（既知の悪用済み脆弱性カタログ）にも、本稿時点では未掲載。普通の会社だと、共有PC・現場端末・管理者端末にVeeam Agentを入れている先の話。一般ユーザーや侵された低権限アカウントから、バックアップ設定・資格情報・端末全体を握られうる。ランサムで「取られたあとの横展開」に効く型。Agentを置いていなければスキップでよい。今見るのは、①バックアップサーバ側が 13.0.2.29以上か。②端末のAgent／トレイが直す版か。③共有端末・複数ユーザーのPCを先に。すぐ上げられない場合は、該当端末へのローカルログオンとローカル管理者・バックアップ権限を必要最小に絞る（公式の恒久回避策はなし）。 https://www.veeam.com/kb4852
Post summary
Veeam disclosed CVE-2026-32996, a local privilege escalation vulnerability in Veeam Agent for Windows (CVSS 7.3). Arctic Wolf confirmed real-world exploitation, and patched versions (Veeam Backup & Replication 13.0.2.29+ and Agent 13.0.3.1220+) are available.
00000114
33 followersView on X
Autumn Good@autumn_good_3518d
Disclosure
CVE-2026-32996 Veeam Agent Local Privilege Escalation | suce's Blog https://suce0155.github.io/posts/veeam_agent_lpe/
Post summary
The snippet announces CVE-2026-32996 as a local privilege escalation in Veeam Agent and points to a blog for details, but offers no PoC, exploit, patch, or evidence of active exploitation.
00000239
7.1K followersView on X
National CERT/CC@CERT_UG19d
Patch
Patch Now | September 23, 2026 Bringing these vulnerabilities to your attention: - Zyxel GS1900 switches (CVE-2026-7273) - Check Point Security Management (CVE-2026-93616, CVSS 9.8) - Veeam Agent for Windows (CVE-2026-32996) https://cert.ug | #CyberSafeUG #CERTUGCC https://t.co/L1Wcbjd0iX
Post summary
The post alerts users to three CVEs affecting Zyxel, Check Point, and Veeam products, includes a CVSS score for one, and urges immediate patching.
0000082
1.5K followersView on X
Aviatrix Threat Research Center@aviatrixtrc19d
Active Exploitation
Chinese threat actor Red Heron exploited Zyxel switches via CVE-2026-7273 to compromise 996 devices across 48 countries, deploying Python collectors to exfiltrate credentials and configurations. Runtime segmentation helps limit blast radius when network infrastructure is compromised. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/zyxel-veeam-flaws-active-exploitation-cve-2026-7273-cve-2026-32996
Post summary
The text reports confirmed active exploitation of CVE-2026-7273 by threat actor Red Heron against Zyxel switches globally, resulting in credential theft across nearly 1,000 devices.
0000057
2.0K followersView on X
protect_cyber_sec@AmirHossein_sec19d
Patch
برای Veeam Agent ، آسیب پذیری با کد شناسایی CVE-2026-32996 از نوع privilege escalation منتشر شده است ، این آسیب پذیری باعث ارتقای سطح دسترسی به یوزر SYSTEM در ویندوز می شود ، نسخه های 13.0.2.1102 و قبل از آن دارای این آسیب پذیری می باشند ، برای مقابله ، به روز رسانی نمایید. https://t.co/eCmE1RRRfo
Post summary
The text announces CVE-2026-32996, a privilege escalation vulnerability in Veeam Agent affecting versions up to 13.0.2.1102, and urgently advises users to update to a patched version. Technical details and a remediation call-to-action are explicitly provided.
0000043
208 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-32996

yousukezan[verified]@yousukezanPoC

The tweet reports the public release of PoC exploit code for the Veeam Agent for Microsoft Windows local privilege escalation vulnerability (CVE-2026-32996), detailing the ability for low-privileged users to execute commands as SYSTEM.

dbugs[verified]@ptdbugsExploit

A PoC/exploit has been discovered for CVE-2026-32996, a local privilege escalation vulnerability in Veeam Agent for Microsoft Windows, with a link to a GitHub repository containing the exploit code.

zoomeyebot[verified]@zoomeyebotActive Exploitation

The alert reports that CVE-2026-32996 in Veeam Agent is actively exploited, granting SYSTEM privileges, and notes that a public PoC has been released.

CyberSignal | Cybersecurity & AI News[verified]@XQOPTRXActive Exploitation

Attackers are actively exploiting a Veeam Agent privilege escalation flaw (CVE‑2026‑32996) to obtain SYSTEM rights on Windows, highlighting the high value of backup software as an attack target.

Rene Robichaud[verified]@ReneRobichaudExploit

The article reports that CVE‑2026‑32996 in Veeam Agent for Windows can be leveraged to obtain SYSTEM privileges and notes that a public exploit for the flaw is available. No patch, workaround, or active exploitation details are provided.

CeptBiro[verified]@CeptBiroPoC

The tweet discloses CVE-2026-32996 in Veeam Agent for Windows, a privilege escalation flaw granting SYSTEM access, and highlights that a public exploit is available.

thibault[verified]@akrilPoC

The text announces the existence of a public exploit for CVE-2026-32996 in Veeam Agent for Windows, highlighting a privilege escalation vulnerability that grants SYSTEM privileges. The primary focus is on confirming the availability of a PoC.

BT Haberler[verified]@BTHaberlerActive Exploitation

Chinese threat actors have been actively exploiting CVE-2026-7273 in Zyxel switches to steal data from 996 devices in 48 countries, and CVE-2026-32996 in Veeam Agent is also actively exploited; federal agencies are required to patch both by September 24.