Security 1 publisher2 min readPublished September 22, 2026 at 4:09 AM PDT

A readable Veeam log file hands any local user SYSTEM on Windows endpoints

Veeam Agent for Windows has a local flaw that promotes a standard account to SYSTEM. Exploit code has been public since September 14. Arctic Wolf says there is no official workaround for systems that cannot patch yet.

The Watch · Security desk

Photograph accompanying A readable Veeam log file hands any local user SYSTEM on Windows endpoints — Photo: thehackernews.com

What happened

The flaw affects Veeam Agent for Microsoft Windows up through version 13.0.1.2067, and every earlier version 13 build is covered too.
Arctic Wolf says elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, a file standard users can read, and a valid UID can then be abused to execute commands as SYSTEM.
The remedy is upgrading Veeam Backup & Replication to 13.0.2.29 or later, which brings the Agent to fixed build 13.0.3.1220.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure Every Windows machine where more than one person holds a local account is now a full-takeover target for the holder of the least privileged one; Arctic Wolf says to prioritise shared workstations, servers and administrator workstations.
capability Per Security Affairs, no memory corruption and no chained second bug are needed, because reading a text file is the whole exploit.
constraint Endpoint patching is gated on a backup server change window, since the fixed agent build ships with the Veeam Backup & Replication upgrade.
decision Teams that cannot take that upgrade now are down to restricting local and interactive access and pulling local administrator and backup operator rights from anyone who does not need them.

An attacker needs local access to the machine before CVE-2026-32996 does anything for them, and what it returns is NT AUTHORITY\SYSTEM from a low-privileged account ^[4]. It is a second-stage tool. The value is to whoever already has a session on a box that other people also log into.

The defect sits in how the Veeam Endpoint Backup service authorises clients on its local gRPC named pipe, \\.\pipe\Veeam\VAW\ServiceConnectionPipe ^[5]. "The service caches an elevated administrator principal against a client-controlled session UID that is not bound to the requesting user or connection," Arctic Wolf wrote ^[6]. The public GitHub proof of concept demonstrates the result by running whoami and writing the output to a file ^[8].

"On September 14, 2026, public technical details and proof-of-concept (PoC) exploit code were released for CVE-2026-32996, increasing the likelihood of exploitation attempts against affected Veeam Agent for Microsoft Windows deployments," Arctic Wolf wrote ^[2]. Security Affairs reports no observed attack ^[16]. It does not name an actor or a ransomware family, and it does not date Veeam's fix.

Inventory comes before the upgrade. Arctic Wolf advises identifying every endpoint still running 13.0.1.2067 or earlier and prioritising systems with multiple local users or privileged tasks ^[11]. Afterwards both the service and the tray component have to report the fixed build, because a partially completed update will not protect the system ^[12].

Arctic Wolf says it can detect multiple stages of this exploitation chain, that customers running the AWN Agent or Aurora Focus get multi-stage endpoint coverage, and that upgrading remains the primary remediation ^[14].

What to watch

Telemetry showing session UID replay against \\.\pipe\Veeam\VAW\ServiceConnectionPipe would be the first sign this has moved from proof of concept into campaign use.
Whether Veeam publishes a standalone agent installer for sites that cannot move the backup server to 13.0.2.29 this month.
Whether the same client-controlled session UID caching pattern appears in other Veeam components that expose local pipes.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
On September 14, 2026, public technical details and a proof-of-concept exploit were released for CVE-2026-32996, a flaw in Veeam Agent for Microsoft Windows.
ReportedSupportedView cited source
[2]
"On September 14, 2026, public technical details and proof-of-concept (PoC) exploit code were released for CVE-2026-32996, increasing the likelihood of exploitation attempts against affected Veeam Agent for Microsoft Windows deployments."
ReportedSupportedSource: Arctic Wolf bulletin, quoted by Security AffairsView cited source
[3]
The flaw affects Veeam Agent for Microsoft Windows up through version 13.0.1.2067 and covers every earlier version 13 build.
ReportedSupportedView cited source
[4]
This is a local privilege escalation bug: the attacker needs local access to the machine first, and a low-privileged user can escalate to NT AUTHORITY\SYSTEM, which on a shared endpoint is enough to fully own the box.
ReportedSupportedView cited source
[5]
"The issue stems from the Veeam Endpoint Backup service's handling of elevated client sessions over the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe."
ReportedSupportedSource: Arctic Wolf bulletin, quoted by Security AffairsView cited source
[6]
"The service caches an elevated administrator principal against a client-controlled session UID that is not bound to the requesting user or connection."
ReportedSupportedSource: Arctic Wolf bulletin, quoted by Security AffairsView cited source
[7]
"Because elevated session UIDs are written to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, which standard users can read, an attacker can obtain a valid UID and abuse it to execute commands as SYSTEM."
ReportedSupportedSource: Arctic Wolf bulletin, quoted by Security AffairsView cited source
[8]
The public GitHub proof of concept demonstrates the flaw by running whoami and writing the output to a file.
ReportedSupportedView cited source
[9]
Arctic Wolf recommends prioritising patching on shared workstations, servers, administrator workstations, and any system where local user access exists or where compromising a low-privileged account could lead to full endpoint takeover.
ReportedSupportedSource: Arctic WolfView cited source
[10]
The fix is to upgrade Veeam Backup & Replication to version 13.0.2.29 or later, which also updates the Agent to build 13.0.3.1220 containing the fix.
ReportedSupportedView cited source
[11]
Before upgrading, identify all endpoints still running 13.0.1.2067 or earlier and prioritise systems with multiple local users or privileged tasks.
ReportedSupportedSource: Arctic Wolf guidance via Security AffairsView cited source
[12]
After the update, check that both the service and tray components are running the fixed version; a partially completed update will not protect the system.
ReportedSupportedView cited source
[13]
There is no official workaround for systems that cannot be patched immediately; as a temporary measure, restrict local and interactive access to affected machines and limit local administrator and backup operator privileges to users who need them.
ReportedSupportedView cited source
[14]
Arctic Wolf says it can detect multiple stages of this exploitation chain, that customers running the AWN Agent or Aurora Focus get multi-stage endpoint coverage, and that upgrading remains the primary remediation.
ReportedSupportedSource: Arctic WolfView cited source
[18]
Security Affairs describes the attack as very easy to carry out, requiring no sophisticated attack chain: reading a text file is the whole exploit.
ReportedSupportedSource: Security AffairsView cited source
[15]
The fixed Agent build 13.0.3.1220 is delivered by upgrading the Veeam Backup & Replication server product to 13.0.2.29 or later, so endpoint remediation depends on a server-side upgrade.
DerivedSupported1 source— sign in to open
[16]
The Security Affairs report and the Arctic Wolf language it quotes describe an increased likelihood of exploitation attempts; they do not report an observed attack, name a threat actor or ransomware family, or give a date for Veeam's fix.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

securityaffairs.com
1 article · September 22, 2026
Public PoC Exposes Critical Veeam Agent Privilege Escalation

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The design error is described in enough detail to reason about: the Veeam Endpoint Backup service caches an elevated administrator principal against a session UID the client supplies, and never checks that the UID belongs to the caller on the other end of the pipe. The same service then writes those UIDs into a log file readable by standard users. Security Affairs puts it as trusting a session ID the user controls. Anyone maintaining a privileged Windows service that authenticates callers over a named pipe has a concrete pattern to compare against, and a reminder that logging an identifier can publish a credential.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence55

0100

Checkable specifics, one chain of custody

The details are the kind an administrator can verify on a running machine: a named pipe, a log at C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, an affected build of 13.0.1.2067, a fixed Agent build of 13.0.3.1220. Every one of them reaches us through Arctic Wolf's bulletin as quoted by Security Affairs, and the proof of concept is described rather than linked or run.

AdoptionInsufficient

No uptake or exploitation figures

Arctic Wolf's language is about the likelihood of attempts, not about attempts it has seen. A proof of concept on GitHub and a fixed build in circulation are events, not measures of uptake: there is no count of exposed endpoints, no patch rate, and no incident to date this against.

Hype gap+15

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Any PostgreSQL replication account can load a shared library as the postgres OS user
4 publishers
build
ShieldBreak: a Defender-to-SYSTEM PoC that your last patch cycle did not stop
1 publisher
build
Microsoft's 966-fix September Patch Tuesday closes two exploited zero-days with security updates
2 publishers
security
Microsoft cleared 18 Azure and Copilot vulnerabilities server-side in one out-of-band batch
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources