Veeam Agent for Windows - A flaw that grants SYSTEM rights

If you're running Veeam Agent to back up a Windows machine, and especially if several people log into it, go check its build number right away because for the past few days, a nasty exploit has been circulating for the CVE-2026-32996 flaw. This one is a hot potato because it lets a local user with no special privileges climb all the way up to the SYSTEM account, i.e. the most powerful account on the machine.

Veeam obviously isn't downplaying the issue and rates this privilege escalation as high severity, with a CVSS score of 7.3 out of 10. It affects the agent in version 13.0.2.1102 as well as all earlier versions in the 13 branch.

Rest assured, they didn't drag their feet since the patch has been available since late May. But apparently a lot of people haven't updated yet, since yesterday the security firm Arctic Wolf reported that attackers were actively exploiting it. However, it's not exactly known how.

So in what case does it actually work?

Well, two conditions need to be met together. First, you need local access to the machine, since this flaw can't be exploited remotely. Second, an administration session must be open in the agent's console (the one used to manage backups).

And from what I gathered, the issue is that this session doesn't kill itself automatically, but only disappears when the console is closed, after a more or less lengthy period of inactivity. Or when the user fully logs off. In other words, on a machine left open all day, it's an open bar!

As a result, Arctic Wolf recommends prioritizing shared workstations, servers, admin machines, and more broadly any computer where an unprivileged account falling into the wrong hands would be enough to take control of the whole machine. Basically, you need to patch first wherever more than one person touches the keyboard.

Now, to secure your machines, it really all depends on how you use the Veeam agent. If it's managed by Veeam Backup & Replication, the fix will arrive on its own, so you don't need to do anything.

However, if you use the agent standalone, it's a bit trickier, because the current version released in August, 13.1.1.700, is not currently published on the automatic update servers. So the notification built into the agent won't offer it to you.

What you actually need to do is open the agent's , to see which build number you're on, and if you're not yet on the latest one, go grab the installer directly from Veeam's download page.

And if you can't update right away, know that there's no official workaround from Veeam. All you can do is restrict local and interactive access to the affected machines, and reserve local administrator and backup operator rights to those who really need them.

So, as you'll have understood, if there's a Veeam Agent version 13 running in your company, make sure you're on at least version 13.0.3.1220.

Alright, take care, cheers!

Source: Security Affairs .

No paywall or programmatic ads. If the site is useful to you and you want it to remain free and independent, you can support it on Patreon.

OpenAI hires three Patreon executives for its creator tools

Lycos.fr is reborn as a engine with free personal pages

Before the UN, Trump renames artificial intelligence

ShinyHunters steals FBI data but swears it's not asking for money

Veeam Agent for Windows - A flaw that grants SYSTEM rights

DREO launches the 720S in France, a heater that blows wherever you want, plus an air purifier

Il y a actuellement 42 visiteurs

Record : 1 337 le 12 juin 2007

Prenez vous en photo !

starfix! on OpenAI hires three Patreon exe

Morgane on Lycos.fr is reborn as a

ts3rv1 on Before the UN, Trump renames a

ponpon on ShinyHunters steals FBI data b

fabien on Veeam Agent for Windows - A fl

Make payments with PayPal

Emplacement d'échange de liens — reconstitution

OpenAI hires three Patreon exe

Lycos.fr is reborn as a

Before the UN, Trump renames a

Use Paypal to donate Utiliser Paypal pour faire un don

Use Allopass to donate Utilisez Allopass pour faire un don

starfix! dans OpenAI hires three Patreon exe

Morgane dans Lycos.fr is reborn as a

ts3rv1 dans Before the UN, Trump renames a

ponpon dans ShinyHunters steals FBI data b

fabien dans Veeam Agent for Windows - A fl

Annonces contextuelles

korben.info (c) 2004/2008 | Liens | Flux RSS des articles