Zero-to-SYSTEM in Veeam Agent: How Attackers Weaponize CVE-2026-32996 via Plaintext Logs and gRPC Named Pipes
Date: September 24, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Windows Vulnerability Research / Privilege Escalation / Ransomware Defense
Tags: Veeam Agent, CVE-2026-32996, gRPC Named Pipe, Local Privilege Escalation, SYSTEM Shell, Ransomware
Executive Summary
Enterprise backup and disaster recovery software has once again emerged as a prime vector for post-exploitation attacks. On September 21–24, 2026, cybersecurity threat intelligence teams at Arctic Wolf, The Hacker News, and SecurityAffairs issued urgent warnings regarding active, in-the-wild exploitation of CVE-2026-32996 (CVSS v3.1 Score: 7.3), a high-severity local privilege escalation (LPE) vulnerability affecting Veeam Agent for Microsoft Windows.
The vulnerability impacts all version 13 builds up to and including 13.0.1.2067. The flaw allows an unprivileged, low-level local user on any Windows workstation, domain-joined laptop, or server to instantly escalate privileges to NT AUTHORITY\SYSTEM—the highest privilege tier on the Windows operating system.
The attack chain represents an astonishingly simple yet devastating design failure: the Veeam Endpoint Backup service (Svc.VeeamEndpointBackup.exe) communicates locally via a gRPC named pipe (\\.\pipe\Veeam\VAW\ServiceConnectionPipe). When elevated administrators interact with the agent or execute backup tasks, the service caches the administrator's security context against a temporary session unique identifier (UID). However, this session UID is not cryptographically bound to the connection or process, and is written in plaintext to a local log file that is world-readable by any standard user on the system. By reading the log file, extracting the active session UID, and dispatching a gRPC call across the named pipe, an attacker achieves instant root execution.
With public proof-of-concept (PoC) code in circulation and active weaponization observed by ransomware operators, immediate patching is mandatory.
Technical Deep-Dive: From World-Readable Log to SYSTEM Shell
To understand why CVE-2026-32996 is so dangerous, we must examine how Veeam Agent manages local IPC communication and session tokens.+-----------------------------------------------------------------------------------+
| CVE-2026-32996 PRIVILEGE ESCALATION CHAIN |
|---|
Low-Privilege Local User Local File System Veeam Endpoint Backup Service
| | (`NT AUTHORITY\SYSTEM`)
| | |
| | 1. Backup job or admin UI executes |
| | Service authenticates admin user |
| |<------------------------------------|
| | |
| | 2. Writes plaintext session log: |
| | `C:\ProgramData\Veeam\Endpoint\ |
| | Svc.VeeamEndpointBackup.log` |
| | "Session UID: [VALID_UUID]" |
| |<------------------------------------|
| | |
| 3. Reads log file | |
| (Permissions: BUILTIN\Users: Read) | |
|--------------------------------------->| |
| 4. Extracts valid Session UID | |
|<---------------------------------------| |
| |
| 5. Connects to gRPC Named Pipe: |
| `\\.\pipe\Veeam\VAW\ServiceConnectionPipe` |
| 6. Sends crafted RPC call: `ExecuteTask(SessionUID, "cmd.exe /c ...")` |
|----------------------------------------------------------------------------->|
| |
| | [MISSING TOKEN BINDING CHECK]
| | - Validates Session UID in cache
| | - Confirms "Admin" permission
| | - Fails to check calling token!
| | - Spawns command as SYSTEM
| |
| 7. SYSTEM Command Executed! |
|<=============================================================================|
v Spawns Interactive Shell -> Disables EDR, Dumps LSASS, Deploys Ransomware v
1. The Architecture of Veeam Endpoint Backup
Veeam Agent for Microsoft Windows operates as a local Windows service (Svc.VeeamEndpointBackup.exe) running under the local system account (NT AUTHORITY\SYSTEM). Because backup operations require raw disk access, Volume Shadow Copy Service (VSS) coordination, and direct filesystem inspection, the service inherently operates with unrestricted operating system permissions.
To allow client management tools (such as the system tray application or management CLI) to control backup schedules, the service exposes a local gRPC named pipe:
\\.\pipe\Veeam\VAW\ServiceConnectionPipe
2. The Root Cause: Unbound Session UIDs & Plaintext Logging
Arctic Wolf’s vulnerability research team identified two compound design vulnerabilities within the service's IPC handler:
A. Unbound Session Authentication
When a user or administrator connects to the named pipe, the service issues an internal SessionUid (a standard GUID). When an elevated administrative operation occurs, the service maps this SessionUid to the caller's elevated WindowsPrincipal object in an internal cache.
However, the service does not bind the session UID to the specific client connection, process ID (PID), or security access token. Any caller that can supply a valid, active SessionUid is automatically granted the permissions associated with that cached session.
B. Plaintext Information Disclosure in World-Readable Logs
To facilitate troubleshooting, the Veeam Endpoint Backup service logs verbose operational telemetry to:
C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log
By default in Windows, directories created under C:\ProgramData inherit permissions that grant standard local users (BUILTIN\Users) Read and Execute permissions.
Crucially, whenever an elevated session is created, the service writes the exact session GUID into this log file:
[24.09.2026 04:12:15] <01> Info [ServiceConnection] Session opened: UID '7b8e1a2f-9c4d-4e5f-8a1b-2c3d4e5f6a7b', User 'DOMAIN\Administrator'
3. The Exploit Mechanics
The public GitHub proof-of-concept demonstrates how trivial exploitation is:
1. Log Scraping: The exploit script opens Svc.VeeamEndpointBackup.log in read mode and uses regular expressions to parse the most recently logged Session UID.
2. Named Pipe Connection: The script opens a standard Windows client handle to \\.\pipe\Veeam\VAW\ServiceConnectionPipe.
3. gRPC Invocation: The script constructs a gRPC request invoking the service’s command-execution RPC methods (such as pre-freeze/post-thaw script execution routines), passing the scraped Session UID in the metadata header.
4. Elevation to SYSTEM: The Veeam service verifies that the Session UID exists in its cache, sees that it corresponds to an elevated administrator, and launches the requested process under the service’s own account: NT AUTHORITY\SYSTEM.
Active Exploitation & Ransomware Threat Landscape
Ransomware operators and cybercriminal access brokers heavily prioritize backup software vulnerabilities during post-compromise lateral movement:
* The "Living-off-the-Backup" Trend: Once attackers gain initial access via phishing or commodity stealers, they search for installed enterprise backup agents (Veeam, Commvault, Veritas) rather than risking noisy kernel exploits.
* Disabling Host Defenses: Obtaining SYSTEM access via Veeam Agent allows attackers to forcefully stop endpoint security agents, unhook kernel drivers, and purge Volume Shadow Copies (vssadmin delete shadows /all /quiet).
* Deploying Local Ransomware: Armed with SYSTEM rights, adversaries deploy encryption lockers without encountering user-account control (UAC) prompts or permission restrictions.
Mitigation & Enterprise Defense Blueprint
Organizations running Veeam Agent for Microsoft Windows must take immediate defensive action across all endpoints.
1. Upgrade Veeam Agent for Windows Immediately (Primary Fix)
Veeam has resolved CVE-2026-32996 in Veeam Agent for Microsoft Windows version 13.0.2 and later. The patch:
* Enforces strict Windows token impersonation checks on all gRPC named pipe connections.
* Redacts session identifiers and security tokens from diagnostic log files.
* Ensure all managed workstations and standalone servers are updated immediately via the Veeam Backup & Replication console or manual package deployment.
2. Immediate Workaround: Restrict Access to Veeam Log Files
If immediate agent patching is delayed, administrators can neutralize the attack vector by removing standard user read access from the Veeam log directory::: Revoke standard user read access from Veeam log directory
icacls "C:\ProgramData\Veeam\Endpoint" /inheritance:d
icacls "C:\ProgramData\Veeam\Endpoint" /remove:g "BUILTIN\Users"
icacls "C:\ProgramData\Veeam\Endpoint" /grant:r "NT AUTHORITY\SYSTEM":(OI)(CI)F
icacls "C:\ProgramData\Veeam\Endpoint" /grant:r "BUILTIN\Administrators":(OI)(CI)F
Note: Restricting read access to the log file prevents low-privileged attackers from obtaining the session UID, severing the exploit chain.
3. Restrict Local and Interactive Logons
* Enforce the principle of least privilege: prevent standard domain users from interactively logging onto sensitive backup servers, domain controllers, and administrator jump boxes.
* Audit systems running Veeam Agent to ensure local admin accounts are strictly restricted.
4. Threat Hunting & SOC Detection Playbook
Security operations centers should deploy the following detection rules:
* Process Lineage Anomaly (Sysmon Event ID 1): Alert on Svc.VeeamEndpointBackup.exe spawning child command interpreters:ParentImage: "C:\\Program Files\\Veeam\\Endpoint Backup\\Svc.VeeamEndpointBackup.exe"
Image:
- "C:\\Windows\\System32\\cmd.exe"
- "C:\\Windows\\System32\\powershell.exe"
- "C:\\Windows\\System32\\whoami.exe"
* Suspicious Named Pipe Connections (Sysmon Event ID 18): Monitor connections to \\pipe\Veeam\VAW\ServiceConnectionPipe originating from processes other than legitimate Veeam binaries (such as Python, PowerShell, or unknown third-party binaries).
For technical threat intelligence advisories, vulnerability breakdowns, and enterprise Windows defense guides, subscribe to Digital Spying.