CVE-2026-32997Patch

MEDIUMCVSS 8.6 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://www.veeam.com/kb4852

Weakness type (CWE)

CWE-36

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 2d ago at 2 mentions (2026-05-28); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification4 categories

Patch

240.0%

Disclosure

120.0%

Active Exploitation

120.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	2	Disclosure1Patch1
2026-05-29	2	Active Exploitation1Patch1
2026-06-10	1	General1

Full discourse5 posts

Autumn Good@autumn_good_35137d
Patch
サイレント修正していた？『These vulnerabilities were fixed starting with the following build: Veeam Backup & Replication 13.0.2.29』 CVE-2026-32996 CVE-2026-32997 KB4852: Vulnerabilities Resolved in Veeam Backup & Replication 13.0.2 https://www.veeam.com/kb4852
Post summary
The advisory confirms that CVE‑2026‑32996 and CVE‑2026‑32997 were remediated in Veeam Backup & Replication 13.0.2.29, with the details available via the provided KB link.
01011541
6.9K followersView on X
CCB Alert@CCBalert136d
Patch
Warning: High severity #vulnerabilities in #Veeam Backup & Replication allow local privilege escalation #LPE and arbitrary file writes. #CVE-2026-32997 CVSS(4.0): 8.6 | #CVE-2026-32996 CVSS(4.0): 7.3. Read the advisory at https://www.veeam.com/kb4852 and #Patch #Patch #Patch
Post summary
The post warns about two high‑severity local privilege escalation vulnerabilities in Veeam Backup & Replication, provides CVSS scores and a link to an advisory that includes patch information.
01000257
7.2K followersView on X
CERT-PY@CERTpy124d
General
⚠️ Vulnerabilidades en productos Veeam ❗ CVE-2026-32998 ❗ CVE-2026-32997 ❗ CVE-2026-32996 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-veeam-6/ https://t.co/fJb6CglTYZ
Post summary
A brief Spanish notice lists three Veeam CVEs, providing no technical context, PoC, or exploit information besides a link for further details.
0000068
6.7K followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
A lot of offensive activities were identified targeting Veeam Backup and Replication (CVE-2026-32997) https://vuldb.com/vuln/366576/cti
Post summary
Multiple adversaries are actively exploiting CVE-2026-32997 against Veeam Backup and Replication, as indicated by reported offensive activities. No PoC, exploit code, patch, or detailed technical information is supplied in the brief mention.
0000071
2.2K followersView on X
ADK Cyber@ADKCyber136d
Disclosure
CVE-2026-32997 (CVSS 8.6) allows authenticated Backup Administrators to write arbitrary files on Linux-based Veeam Backup & Replication servers. Organizations using Veeam should review access controls and apply vendor guidance. https://nvd.nist.gov/vuln/detail/CVE-2026-32997 http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning
Post summary
CVE‑2026‑32997 allows authenticated Veeam backup administrators to write arbitrary files on Linux servers, and users are urged to review access controls and follow vendor guidance.
0000035
81 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-32997

ADK Cyber[verified]@ADKCyberDisclosure

CVE‑2026‑32997 allows authenticated Veeam backup administrators to write arbitrary files on Linux servers, and users are urged to review access controls and follow vendor guidance.

Autumn Good@autumn_good_35Patch

The advisory confirms that CVE‑2026‑32996 and CVE‑2026‑32997 were remediated in Veeam Backup & Replication 13.0.2.29, with the details available via the provided KB link.

CCB Alert@CCBalertPatch

The post warns about two high‑severity local privilege escalation vulnerabilities in Veeam Backup & Replication, provides CVSS scores and a link to an advisory that includes patch information.

CERT-PY@CERTpyGeneral

A brief Spanish notice lists three Veeam CVEs, providing no technical context, PoC, or exploit information besides a link for further details.

VulDB 🛡@vuldbActive Exploitation

Multiple adversaries are actively exploiting CVE-2026-32997 against Veeam Backup and Replication, as indicated by reported offensive activities. No PoC, exploit code, patch, or detailed technical information is supplied in the brief mention.