Attackers exploit Veeam Agent flaw to gain SYSTEM-level Windows access

Arctic Wolf warned that attackers are exploiting CVE-2026-32996, a local privilege-escalation flaw in Veeam Agent for Microsoft Windows that can give a user with local access SYSTEM-level control. The backup service caches an elevated administrator identity against a client-controlled session identifier without binding it to the requesting user or connection. Standard users can read valid elevated identifiers from a Veeam log file and reuse them to execute commands with the highest Windows privileges. The flaw carries a CVSS score of 7.3, and exploitation still requires local access to an affected endpoint.