Vulnerability · Published May 28, 2026 · Assigned by hackerone
CVE-2026-32996
High 7.3
In plain English
A high-severity sensitive data in logs in Backup and Replication from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.2%top 94.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup and Replication | 13 – through 13.0.1 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N