Veeam Agent EUVD-2026-32712

Attacker must already hold a low-privileged authenticated local session on a Windows host where Veeam Agent for Microsoft Windows (from Veeam Backup and Replication 13, version ≤13.0.1) is installed, matching the CVSS 4.0 vector's AV:L and PR:L. The AT:P bit means exploitation also depends on the sensitive data actually being present in a readable log at the moment of access - i.e., the targeted backup operation or service event that triggers the CWE-532 disclosure must have occurred and the log retention/ACLs must leave the file reachable by the attacker's user. Limiting factors: no remote network exploitation path, no path that works against a host without an interactive logon, UI:N means no user interaction is needed once the attacker is on the box, and SC:N/SI:N/SA:N confirms the vulnerability does not by itself cross a security boundary to another system without the attacker then reusing the harvested credentials.

The CVSS 4.0 vector AV:L/AC:L/AT:P/PR:L/UI:N tells a consistent story of a local, low-complexity, authenticated attack that does require a specific attack precondition (AT:P) such as the sensitive data actually being present in the log at the time of access, with high VC/VI/VA but no scope or subsequent-system impact (SC:N/SI:N/SA:N). The 7.3 score is therefore a realistic medium-to-high local risk rather than an inflated network-exploitable critical, and it is consistent with the description's 'Local Privilege Escalation' framing - there is no conflict between the vector and the prose. There is no EPSS or KEV signal supplied and no public exploit identified at time of analysis, so this is best treated as a credible insider/post-compromise escalation path on Veeam-protected Windows hosts rather than an internet-facing emergency; however, because Veeam endpoints commonly hold backup-operator-grade credentials, successful exploitation is a high-value pivot for ransomware and intrusion actors who already have a foothold.

An attacker who has obtained any low-privileged interactive or RDP session on a Windows server running Veeam Agent - for example via a phished helpdesk account or a prior commodity-malware foothold - reads the agent's log files from disk, extracts sensitive material that CWE-532 indicates is being logged (such as service credentials or tokens), and reuses it to act with the backup service's elevated rights. From there the attacker can read protected backup data, tamper with backup jobs, or pivot to the Veeam Backup and Replication server to stage ransomware-style backup destruction; no public exploit is identified at time of analysis but the technique is mechanically simple once a foothold exists.