CVE-2026-32996
No known exploitation. EPSS puts it in the 3rd percentile. No fix published yet.
What to do
No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record- Check whether Backup and Replication is installed on Windows systems and identify which staff, service accounts, or other users can log in locally.
- Ask your software vendor whether CVE-2026-32996 affects your installed release; no fixed version has been published.
- Until a fix is available, restrict local access to affected systems to trusted administrators and remove unnecessary local accounts.
- Review access to the product's log files and investigate unexpected attempts to read or copy them.
What it is
From the CVE record
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
In plain language
Written by AI from the recordThis is an urgent flaw in Backup and Replication that can let someone already using the affected computer gain administrator-level control.
Local privilege escalation through improper logging of sensitive information in Veeam Agent for Microsoft Windows, enabling a low-privileged local user to obtain administrative privileges.
If you're affected
- Full system takeover
- Backup data exposure
- Backup job disruption
- Ransomware risk
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.1% chance of exploitation activity in the next 30 days, which ranks it in the 3rd percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
- Attention now
Sustained, driven by in-the-wild reports.
Lifecycle
6 events over 118 days, from the signal feeds we watch.
- Record updated
- OpenVAS check added
- Record updated
- Publishedweakness classified, att&ck mapped
Affected products
Technical detail
Weaknesses
ATT&CK techniques
Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.
- Credential AccessT1552Unsecured Credentialsmedium confidence
Sources
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Backup And Replication, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI