# CVE-2026-32997: Veeam Backup & Replication arbitrary file write in Software Appliance

Source: https://junglewise.ai/threats/cve-2026-32997-veeam-backup-replication-arbitrary-file-write-in-software  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-32997 · Severity: info · CVSS 8.6 · Published 2026-05-28

Veeam Backup & Replication is a data protection solution used to back up, restore, and replicate virtual and physical machines. A vulnerability in the Linux-based software appliance version allows an authorized administrator to write files to any location on the server's file system. This could be used by a high-privileged user to modify system configurations or gain deeper control over the backup infrastructure, potentially compromising the integrity of stored data.

Technologies: [Veeam Backup & Replication](https://junglewise.ai/threats/technologies/backup-replication). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-32997 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32997 being exploited in the wild.

**How severe is CVE-2026-32997?** Informational severity, with a CVSS score of 8.6, published 28 May 2026.

**Which products and versions are affected?** Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds.

**Is there a fix for CVE-2026-32997?** A patch was published on 2026-05-27: Fixed in version 13.0.2.29 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32997 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32997?** Check whether you run Veeam Backup & Replication at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-36) exists in the Linux-based Veeam Backup & Replication server (Veeam Software Appliance). The flaw allows an authenticated user with the 'Backup Administrator' role to bypass intended file system restrictions and write arbitrary files to the underlying operating system. While the attack requires high privileges (PR:H), it enables an attacker to achieve full impact on confidentiality, integrity, and availability of the appliance. The issue is resolved in Veeam Backup & Replication version 13.0.2.29.

## Affected products

- Veeam Backup & Replication (Software Appliance) 13.0.1.2067 and all earlier version 13 builds

## Timeline

- 2026-05-27: patched: Fixed in version 13.0.2.29
- 2026-05-27: advisory: Veeam KB4852 published
- 2026-05-28: disclosed: CVE-2026-32997 published to NVD

## References

- [https://www.veeam.com/kb4852](https://www.veeam.com/kb4852)

## Related threats

- [Veeam Backup & Replication authorization bypass in CDP Coordinator](https://junglewise.ai/threats/cve-2026-108142-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass)
- [Veeam Backup & Replication path traversal in restore](https://junglewise.ai/threats/cve-2026-108141-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication path traversal via restore operator](https://junglewise.ai/threats/cve-2026-108140-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication privilege escalation in Enterprise Manager](https://junglewise.ai/threats/cve-2026-93026-this-vulnerability-in-veeam-backup-replication-allows-a-backup)
- [Veeam Backup & Replication arbitrary file read in Cloud Connect](https://junglewise.ai/threats/cve-2026-58069-this-vulnerability-in-veeam-backup-replication-allows-an)