--- schema: 1 kind: vulnerability title: "CVE-2026-32996 & CVE-2026-32997 — Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance" headline: "CVE-2026-32996 & CVE-2026-32997 — Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance" summary: "Veeam shipped KB4852 / Backup & Replication patch version 13.0.2.29 on 2026-05-27. CVE-2026-32996 (CVSS 7.3) is a local privilege escalation in the Veeam Agent for Microsoft Windows component — an attacker with limited system access can elevate to enable arbitrary command execution, security-control disablement or …" discovered_at: "2026-05-29T05:00:11Z" event_date: 2026-05-27 run_id: 2026-05-29-c7f56b00 priority: notable immediate_action: null tags: - vulnerabilities - lpe - patch-available regions: - europe - global sectors: - public-sector - finance - healthcare entities: [] cves: - id: CVE-2026-32996 cvss: "7.3" epss: null type: lpe vector: local auth: post-auth status: - patch-available - id: CVE-2026-32997 cvss: "8.6" epss: null type: lpe vector: local auth: post-auth status: - patch-available sources: - url: "https://www.veeam.com/kb4852" publisher: Veeam KB4852 role: primary - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0652/" publisher: CERT-FR CERTFR-2026-AVI-0652 role: corroborating - url: "https://cybersecuritynews.com/veeam-backup-replication-tool-vulnerability/" publisher: CybersecurityNews role: corroborating closed_sources: [] evidence: - quote: authenticated user with the Backup Administrator role to write arbitrary files publisher: Veeam KB4852 - quote: permits attackers with limited system access to escalate privileges and gain deeper access to enterprise systems publisher: CybersecurityNews verification: multi-source sourcing_note: null confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null watchlist_hit: false actions: [] migrated_from: briefs/2026-05-29.md --- [Veeam shipped KB4852 / Backup & Replication patch version 13.0.2.29 on 2026-05-27](https://www.veeam.com/kb4852). `CVE-2026-32996` (CVSS 7.3) is a local privilege escalation in the Veeam Agent for Microsoft Windows component — an attacker with limited system access can elevate to enable arbitrary command execution, security-control disablement or lateral movement; reporter Alibaba via HackerOne. `CVE-2026-32997` (CVSS 8.6) is an arbitrary file write in the Veeam Software Appliance (Linux) constrained to authenticated users with the Backup Administrator role; depending on the target path (cron, `authorized_keys`, library hijack), this is a stepping stone to RCE or persistence. Both affect all version-13 builds before fixed version 13.0.2.29. [CERT-FR / ANSSI advisory CERTFR-2026-AVI-0652](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0652/) corroborates. No exploitation reported; Veeam notes patch-reverse-engineering risk after disclosure. Veeam is the dominant backup platform in EU public-sector on-premise environments — patch the appliance and Windows agent fleet in tandem with backup-administrator least-privilege review. #### CVE Summary Table | CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source | |---|---|---|---|---|---|---|---| | CVE-2026-35616 | Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.1 | 43.2% | Yes (2026-04-06) | Yes — EKZ Infostealer | EMS 7.4.7 | [Fortinet PSIRT](https://fortiguard.fortinet.com/psirt/FG-IR-26-099) | | CVE-2026-4408 | Samba (SAMR RPC) | 10.0 | n/a | No | No | 4.22.10 / 4.23.8 / 4.24.3 | [Samba Project](https://www.samba.org/samba/security/CVE-2026-4408.html) | | CVE-2026-4480 | Samba (print command) | 10.0 | n/a | No | No | 4.22.10 / 4.23.8 / 4.24.3 | [Samba Project](https://www.samba.org/samba/security/CVE-2026-4480.html) | | CVE-2026-9170 | IBM HTTP Server / WebSphere | 9.8 | 0.049% | No | No | APAR PH71265 | [IBM Security Bulletin](https://www.ibm.com/support/pages/node/7274065) | | CVE-2026-44939 | SUSE Rancher (cluster import) | 9.6 | n/a | No | No | 2.10.12 / 2.11.14 / 2.12.10 / 2.13.6 / 2.14.2 | [SUSE GHSA](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62) | | CVE-2026-44848 | Portainer CE (Docker plugin endpoints) | 9.4 | n/a | No | No | 2.33.8 / 2.39.2 / 2.41.0 | [Portainer GHSA](https://github.com/portainer/portainer/security/advisories/GHSA-rrmm-9v76-h3p4) | | CVE-2026-44849 | Portainer CE (Swarm service bypass) | 9.4 | n/a | No | No | 2.33.8 / 2.39.2 / 2.41.0 | [CCB Belgium](https://ccb.belgium.be/advisories/warning-two-critical-vulnerabilities-portainer-allow-full-host-takeover-patch) | | CVE-2026-41053 | SUSE Rancher (GitHub App auth) | 8.8 | n/a | No | No | 2.13.6 / 2.14.2 | [SUSE GHSA](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh) | | CVE-2026-32997 | Veeam Backup Linux appliance | 8.6 | n/a | No | No | version 13.0.2.29 | [Veeam KB4852](https://www.veeam.com/kb4852) | | CVE-2026-41052 | SUSE Rancher (PSA priv-esc) | 8.4 | n/a | No | No | 2.12.10 / 2.13.6 / 2.14.2 | [SUSE GHSA](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744) | | CVE-2026-4868 | GitLab CE/EE (Duo AI) | 8.2 | n/a | No | No | 19.0.1 / 18.11.4 / 18.10.7 | [GitLab](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-1-released/) | | CVE-2026-32996 | Veeam Windows Agent | 7.3 | n/a | No | No | version 13.0.2.29 | [Veeam KB4852](https://www.veeam.com/kb4852) | | CVE-2026-6713 | GitLab CE/EE (project enumeration) | 5.3 | n/a | No | No | 19.0.1 / 18.11.4 / 18.10.7 | [GitLab](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-1-released/) |