CVE-2026-32997: Veeam Backup & Replication arbitrary file write in Software Appliance

CVE-2026-32997 · Severity: info · CVSS 8.6 · Published 2026-05-28

Veeam Backup & Replication is a data protection solution used to back up, restore, and replicate virtual and physical machines. A vulnerability in the Linux-based software appliance version allows an authorized administrator to write files to any location on the server's file system. This could be used by a high-privileged user to modify system configurations or gain deeper control over the backup infrastructure, potentially compromising the integrity of stored data.

Technologies: Veeam Backup & Replication. Vendors: Veeam.

Quick answers

Is CVE-2026-32997 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32997 being exploited in the wild.
How severe is CVE-2026-32997?
Informational severity, with a CVSS score of 8.6, published 28 May 2026.
Which products and versions are affected?
Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds.
Is there a fix for CVE-2026-32997?
A patch was published on 2026-05-27: Fixed in version 13.0.2.29 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32997 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32997?
Check whether you run Veeam Backup & Replication at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-36) exists in the Linux-based Veeam Backup & Replication server (Veeam Software Appliance). The flaw allows an authenticated user with the 'Backup Administrator' role to bypass intended file system restrictions and write arbitrary files to the underlying operating system. While the attack requires high privileges (PR:H), it enables an attacker to achieve full impact on confidentiality, integrity, and availability of the appliance. The issue is resolved in Veeam Backup & Replication version 13.0.2.29.

Affected products

  • Veeam Backup & Replication (Software Appliance) 13.0.1.2067 and all earlier version 13 builds

Timeline

  • 2026-05-27: patched: Fixed in version 13.0.2.29
  • 2026-05-27: advisory: Veeam KB4852 published
  • 2026-05-28: disclosed: CVE-2026-32997 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.