Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-32996 |
| Alert Source | Veeam Security Advisory |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | Veeam |
| Product | Service Provider Console / Backup & Replication |
| Vulnerability Type | Arbitrary File Write / Privilege Escalation |
| CVSS Score | 8.8 (high) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
This is the second of two high-severity vulnerabilities published in the same Veeam Security Advisory bundle alongside CVE-2026-32998 (critical RCE) and CVE-2026-32997. It allows an attacker to perform unauthorized arbitrary file writes and potentially gain elevated privileges on vulnerable instances of Veeam Service Provider Console and Veeam Backup & Replication.
Required Actions
Promptly update the vulnerable Veeam products to the latest vendor-supported versions:
- Veeam Service Provider Console — upgrade from 9.x to 9.2.0.33215 or later
- Veeam Backup & Replication — upgrade from 13.x to 13.0.1.2067 or later
All three vulnerabilities (CVE-2026-32998, CVE-2026-32997, CVE-2026-32996) are addressed in a single patch package — one update eliminates the entire bundle. Until patches are deployed, restrict access to Veeam management interfaces to trusted administrative segments and enforce MFA for privileged accounts.
Who Is Affected?
This vulnerability affects:
- Veeam Service Provider Console versions 9.x prior to 9.2.0.33215
- Veeam Backup & Replication versions 13.x prior to 13.0.1.2067
The highest update priority is for managed service providers (MSP/CSP) offering Veeam in a multi-tenant model — compromise of the central VSPC console has a cascading impact on every customer served from that platform. Treat all three CVEs in this bundle together; do not deploy updates selectively.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
