PatchSiren cyber security CVE debrief

CVE-2026-32996 Veeam CVE debrief

A local privilege escalation vulnerability in Veeam Agent for Microsoft Windows was disclosed on May 28, 2026. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File) and carries a CVSS 4.0 score of 7.3 (HIGH). The attack requires local access with low privileges and no user interaction, potentially allowing an attacker to gain high confidentiality, integrity, and availability impacts on the affected system. Veeam has published a knowledge base article addressing this issue.

Vendor: Veeam
Product: Backup and Replication
CVSS: HIGH 7.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-29
Advisory published: 2026-05-28
Advisory updated: 2026-05-29

Who should care

Organizations running Veeam Agent for Microsoft Windows for backup and disaster recovery operations, particularly those with multi-user environments where local privilege boundaries must be enforced. Security teams managing backup infrastructure and compliance officers concerned with data exposure in log files.

Technical summary

CVE-2026-32996 affects Veeam Agent for Microsoft Windows and enables local privilege escalation through insertion of sensitive information into log files (CWE-532). The vulnerability requires local attack vector with low attack complexity and low privileges, but no user interaction. Successful exploitation yields high impact across confidentiality, integrity, and availability dimensions. The CVSS 4.0 score of 7.3 reflects significant risk for enterprise backup infrastructure where Veeam agents are widely deployed.

Defensive priority

HIGH

Recommended defensive actions

Review Veeam knowledge base article KB4852 for patch availability and mitigation guidance
Apply security updates for Veeam Agent for Microsoft Windows when available
Audit local access controls on systems running Veeam Agent for Microsoft Windows
Review log file permissions and sanitization practices to prevent sensitive information exposure
Monitor for anomalous local privilege escalation attempts on backup infrastructure

Evidence notes

CVE published and modified 2026-05-28T05:16:35.637Z. CVSS 4.0 vector: AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H. Weakness: CWE-532. VulnStatus: Received. Vendor attribution based on reference domain candidate 'Veeam' and official knowledge base reference.

Official resources

2026-05-28