An Endpoint Login Can Gain Machine Control
Restricted local users can reach NT AUTHORITY\SYSTEM through vulnerable Veeam Agent for Microsoft Windows. suce’s analysis requires an active, valid elevated session. CVE-2026-32996 provides no unauthenticated network entry; public code does not establish actual attacks.
Escalation can expose protected data and backup credentials, disable security controls and alter restoration operations or recovery evidence.
The demonstration labels Agent through 13.0.2.1102 vulnerable; its fix list identifies 13.0.3.1220. The advisory separately covers Backup & Replication 13 through 13.0.1.2067, fixed in 13.0.2.29. Compare builds on the same product track.
The endpoint release table, updated 27 October 2026, also lists 13.1.2.812. Earlier 13.0.4 and 13.1 releases remain listed. For branch 6, consult its own support guidance; these branch 13 numbers do not establish its applicability or fix.
- Inventory protected endpoints by product, edition, branch and exact build.
- Apply supported fixed builds on each deployment’s own release track.
- Verify delivery to intermittently connected laptops and servers.
- Review local accounts, interactive logons and process creation throughout exposure since public code appeared.
- Investigate unexpected commands from backup services and unusual reads of their logs.
- Separate backup credentials and recovery infrastructure from ordinary endpoint trust.
Canada’s Cyber Centre cited public reports of exploitation in its 21 September update. The official record rates the issue 7.3 under CVSS 4.0. CISA’s catalogue captured on 28 October contains no matching entry. Neither observation proves exploitation absent; confirm patch delivery and investigate the earlier exposure.
