CVE-2026-32996 & CVE-2026-32997 — Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance
Veeam shipped KB4852 / Backup & Replication patch version 13.0.2.29 on 2026-05-27. CVE-2026-32996 (CVSS 7.3) is a local privilege escalation in the Veeam Agent for Microsoft Windows component — an attacker with limited system access can elevate to enable arbitrary command execution, security-control disablement or lateral movement; reporter Alibaba via HackerOne. CVE-2026-32997 (CVSS 8.6) is an arbitrary file write in the Veeam Software Appliance (Linux) constrained to authenticated users with the Backup Administrator role; depending on the target path (cron, authorized_keys, library hijack), this is a stepping stone to RCE or persistence. Both affect all version-13 builds before fixed version 13.0.2.29. CERT-FR / ANSSI advisory CERTFR-2026-AVI-0652 corroborates. No exploitation reported; Veeam notes patch-reverse-engineering risk after disclosure. Veeam is the dominant backup platform in EU public-sector on-premise environments — patch the appliance and Windows agent fleet in tandem with backup-administrator least-privilege review.
CVE Summary Table
| CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-35616 | Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.1 | 43.2% | Yes (2026-04-06) | Yes — EKZ Infostealer | EMS 7.4.7 | Fortinet PSIRT |
| CVE-2026-4408 | Samba (SAMR RPC) | 10.0 | n/a | No | No | 4.22.10 / 4.23.8 / 4.24.3 | Samba Project |
| CVE-2026-4480 | Samba (print command) | 10.0 | n/a | No | No | 4.22.10 / 4.23.8 / 4.24.3 | Samba Project |
| CVE-2026-9170 | IBM HTTP Server / WebSphere | 9.8 | 0.049% | No | No | APAR PH71265 | IBM Security Bulletin |
| CVE-2026-44939 | SUSE Rancher (cluster import) | 9.6 | n/a | No | No | 2.10.12 / 2.11.14 / 2.12.10 / 2.13.6 / 2.14.2 | SUSE GHSA |
| CVE-2026-44848 | Portainer CE (Docker plugin endpoints) | 9.4 | n/a | No | No | 2.33.8 / 2.39.2 / 2.41.0 | Portainer GHSA |
| CVE-2026-44849 | Portainer CE (Swarm service bypass) | 9.4 | n/a | No | No | 2.33.8 / 2.39.2 / 2.41.0 | CCB Belgium |
| CVE-2026-41053 | SUSE Rancher (GitHub App auth) | 8.8 | n/a | No | No | 2.13.6 / 2.14.2 | SUSE GHSA |
| CVE-2026-32997 | Veeam Backup Linux appliance | 8.6 | n/a | No | No | version 13.0.2.29 | Veeam KB4852 |
| CVE-2026-41052 | SUSE Rancher (PSA priv-esc) | 8.4 | n/a | No | No | 2.12.10 / 2.13.6 / 2.14.2 | SUSE GHSA |
| CVE-2026-4868 | GitLab CE/EE (Duo AI) | 8.2 | n/a | No | No | 19.0.1 / 18.11.4 / 18.10.7 | GitLab |
| CVE-2026-32996 | Veeam Windows Agent | 7.3 | n/a | No | No | version 13.0.2.29 | Veeam KB4852 |
| CVE-2026-6713 | GitLab CE/EE (project enumeration) | 5.3 | n/a | No | No | 19.0.1 / 18.11.4 / 18.10.7 | GitLab |
authenticated user with the Backup Administrator role to write arbitrary files
permits attackers with limited system access to escalate privileges and gain deeper access to enterprise systems
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.