{"id":"CVE-2026-32996","published":"2026-05-28T04:01:37Z","modified":"2026-09-23T03:55:30Z","title":"This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation","vendor":"Veeam","product":"Backup and Replication","tier":"core","eol":null,"affectedVersions":[{"vendor":"Veeam","product":"Backup and Replication","versions":[">= 13, <= 13.0.1"]}],"description":{"text":"This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.3,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00167,"percentile":0.05946,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-16","exploitedFirstSeen":"2026-09-16","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/update-active-exploitation-cve-2026-32996-of-veeam-agent/","date":"2026-09-16"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Known_Cve | Jun 6, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a22d9d836983549a180365a","created":"2026-06-05"},{"name":"Known_Cve | Jun 5, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a2188cdee94b8b1334c441e","created":"2026-06-04"},{"name":"Known_Cve | Jun 5, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a21889ae114a85c10b9adbf","created":"2026-06-04"},{"name":"Known_Cve | Jun 4, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a2036fb506fe8123d65b94b","created":"2026-06-03"},{"name":"Known_Cve | Jun 3, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1ee53f4af43df5b5f4403e","created":"2026-06-02"},{"name":"Known_Cve | Jun 2, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1d945db4f5a5371b3864a3","created":"2026-06-01"},{"name":"Known_Cve | Jun 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1c426cbf0e554982e6da7a","created":"2026-05-31"},{"name":"Known_Cve | May 31, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1af0efff4b7dd243573ef5","created":"2026-05-30"},{"name":"Known_Cve | May 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a199f66a765b0a5dce00131","created":"2026-05-29"},{"name":"Known_Cve | May 29, 2026","url":"https://otx.alienvault.com/pulse/6a184eb0b82a588940895fc7","created":"2026-05-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"references":[{"url":"https://www.veeam.com/kb4852","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-32712","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32712","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-15","earliestUrl":"https://github.com/suce0155/CVE-2026-32996","repos":[{"name":"suce0155/CVE-2026-32996","url":"https://github.com/suce0155/CVE-2026-32996","stars":6,"created":"2026-09-15"}]},"first":{"date":"2026-09-15","source":"PoC-in-GitHub","url":"https://github.com/suce0155/CVE-2026-32996"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-32996","provenance":"source"},{"date":"2026-09-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/suce0155/CVE-2026-32996","provenance":"source"},{"date":"2026-09-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/update-active-exploitation-cve-2026-32996-of-veeam-agent/","provenance":"source"}],"speed":{"daysToPublicExploit":110,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":58.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 45 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":1.19,"detail":"percentile 0.0595"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}