Veeam KB4852 documents CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows: a low-privileged local user can obtain SYSTEM by abusing elevated session UIDs cached against a client-controlled session UID on the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe (UIDs readable from C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log). Vendor CVSS 4.0 score 7.3 High (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

KB4852 says the flaws it lists affect Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds. Fixed starting with Veeam Backup & Replication 13.0.2.29; Veeam's Agent for Windows fix list (KB3108) shows CVE-2026-32996 fixed in Agent build 13.0.3.1220.

Arctic Wolf warned of active exploitation after a public proof-of-concept (PoC) exploit was posted on GitHub, as reported by The Hacker News (22 September 2026) — prioritise shared workstations, admin endpoints, and multi-user hosts. Same KB also ships CVE-2026-32997 (Backup Administrator arbitrary file write on Linux Veeam Software Appliance; CVSS 4.0 8.6) fixed in the same 13.0.2.29 build. Primary: Veeam KB4852; Agent fix build: Veeam KB3108; exploitation context: Arctic Wolf via The Hacker News 22 Sep 2026.

Correction (24 Oct 2026): KB4852 gives the affected range as Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds, not Agent builds; the fixed Agent build 13.0.3.1220 is now sourced to Veeam KB3108 because the Arctic Wolf post no longer loads. (source: Veeam KB4852)