The Veeam agent that writes the copies can become SYSTEM

This morning we wrote the WAN box, the closet switch, and a SharePoint bulletin that said spoofing. Tuesday's other clock is the Windows Update Stack, due today. The story we left on the table sits in the backup agent. CVE-2026-32996 is a local climb to SYSTEM in Veeam Agent for Microsoft Windows. Arctic Wolf titled the note active exploitation. A public test has been out since September 14. The Hacker News put it next to the Zyxel KEV this morning. We already used the switch. The agent is the one that is supposed to save you after the switch is gone.

What the agent bug actually is

Veeam's KB4852 is short. Version 13 through 13.0.1.2067 on the Windows agent. A logged-on user can become NT AUTHORITY\SYSTEM. Score is 7.3. Local only. No vendor workaround in the note Arctic Wolf reviewed. The fix rides with Backup and Replication 13.0.2.29, which pushes the agent to 13.0.3.1220. After the upgrade you check the service and the tray, not the console green light.

We are not going to walk the service. A public proof is already on GitHub. That is a reason to patch shared boxes first, not a lab on the file server. Shared workstations, help-desk PCs, and anything a contractor can log onto locally are the ones Arctic Wolf said to do first. A low-privilege account that becomes SYSTEM on a box that also holds backup credentials is the whole week in one sentence.

The same KB names a sibling, CVE-2026-32997, on the Linux Veeam Software Appliance: a Backup Administrator can write files they should not. Different product, same Tuesday. If you run the appliance, 13.0.2.29 covers that too.

Why this sits next to File History

Yesterday we said the September KBs that close the Update Stack can go quiet on File History. Do not uninstall those KBs. Do look at the last backup date. Today's Veeam note is the other half of that sentence. The copies can stop writing, and the agent that writes them can become the privilege path. Acronis on a hosting panel last week, Netcore restore.cgi yesterday, File History yesterday afternoon, Veeam Agent today. Four logos. One question: who can become the backup, and when did anyone prove a restore.

A lot of Alberta shops put Veeam Agent on laptops and a NAS job on the shop PC and call it done. Version 13.0.1 looks current until you read the fourth number. 13.0.3.1220 is the one that matters. If the console shows 13 and you stop there, you are still on the affected train.

The rest of Tuesday, in one paragraph

Update Stack CVE-2026-81963 is due today. Zyxel GS1900 is due Thursday. VeloCloud on-prem is already being used if you still have certificate Edge auth and an old build. SharePoint 65660 has public details and an August 11 patch. D-Link told owners of the old DIR-822A there is a max-severity DHCP hole (CVE-2026-86296) with a public test and no patch, plus a second L2TP bug they are still looking at. Take that router off the internet and plan a replacement. Do not fetch the test. Comment2Shell in WordPress 7.1.1 and the Defender update-blocker from the weekend are real and not this article. None of those move the Veeam build check.

What we would check before the day is over

• Write the Veeam Agent build on every Windows box that has it. 13.0.1.2067 and earlier go to 13.0.3.1220 or later. The clean path is Backup and Replication 13.0.2.29 or newer, then confirm the agent and the tray actually moved.
• Do the shared and admin boxes first. Limit who can sit at those keyboards until the build is new.
• Finish today's Update Stack KB. Then open File History or the real job and confirm a new copy landed. The stamp is the evidence.
• Do not download the public Veeam test or the D-Link test. Isolate the DIR-822A. Flash the GS1900 if you have not.

Bottom line

A backup agent that can become SYSTEM is not a backup feature. Forensic Five reviews the build, who can log on locally, and whether a restore still works the week you patched Windows. From St. Albert, Alberta. Move the agent. Keep the September KB. Look at the last copy like someone may have stopped writing.