CVE-2026-32997

Executive Summary

CVE-2026-32997 is a high-severity arbitrary file write vulnerability affecting Linux-based Veeam Backup & Replication servers. An authenticated user possessing the Backup Administrator role can exploit this flaw to write arbitrary files on the underlying operating system, potentially achieving remote code execution or full system compromise. The vulnerability carries a CVSS score of 8.6, and with no vendor patch currently available, affected organizations face a significant window of exposure to insider threats and credential-compromised attacks.

Technical Analysis

The vulnerability resides in the file handling logic of Veeam Backup & Replication running on Linux platforms. It is classified under CWE-36 (Absolute Path Traversal), indicating that the application fails to properly validate or sanitize user-supplied file paths when processing backup operations. The core mechanism involves the Backup Administrator role's legitimate capability to initiate and manage backup jobs — an attacker with this privilege can manipulate file path parameters submitted to the backup service to escape intended directory boundaries.

The attack surface is the Veeam Backup & Replication management interface, which is typically exposed on TCP port 9419 (management service) and 6172 (Veeam Agent) on Linux installations. The vulnerability allows the authenticated Backup Administrator to craft requests that write data to arbitrary file system locations, bypassing the application's intended write-path restrictions.

Because the flaw is present in the server's file-write functionality rather than a specific versioned code branch, versions of Veeam Backup & Replication for Linux that implement the Backup Administrator role are potentially affected. The absence of patch evidence from any tracked source, combined with a patch confidence of 0/4, suggests that no vendor fix has been publicly released, and the vulnerability remains unpatched in the wild.

The arbitrary file write capability, when combined with common Linux techniques such as writing to startup scripts, cron jobs, or web-accessible directories, escalates from a file-write primitive to a full remote code execution path. The CVSS vector reflects this — the high base score (8.6) derives from network-based attack vector, low attack complexity, low privileges required, and a scope change, with high confidentiality and integrity impacts.

Exploitation Scenarios

Scenario 1: Cron-Based Persistence

1. Reconnaissance: The attacker first identifies a target Veeam Backup & Replication Linux server. This may be achieved through Shodan searches for exposed management ports (9419, 9440, 443) or through internal network enumeration after initial access to the corporate network.
2. Credential Acquisition: The attacker obtains valid credentials for an account with the Backup Administrator role. This could come from phishing, credential stuffing, or lateral movement from a compromised lower-privilege account.
3. Authentication & Path Traversal Weaponization: The attacker authenticates to the Veeam management interface. Using the legitimate backup job creation or modification functionality, the attacker crafts a request that specifies a file path containing path traversal sequences (e.g., ../../../../etc/cron.d/). Because the application fails to normalize or validate these paths, it resolves to a location outside the intended backup staging directory.
4. Payload Delivery: The attacker submits the malicious backup job configuration. The backup job includes a payload file whose content is written directly to the traversed path. For instance, the attacker writes a cron entry to /etc/cron.d/backdoor that executes a reverse shell or downloads a second-stage payload.
5. Execution & Persistence: The cron daemon picks up the new job on its next scheduled run, executing the attacker's command. The attacker establishes a persistent foothold on the server.
6. Post-Exploitation Impact: With root-level execution (if cron runs as root), the attacker can exfiltrate encrypted backup data, dump credentials from the Veeam configuration, pivot to the backing storage infrastructure, and potentially compromise linked vCenter or ESXi hosts through trusted backup connections.

Scenario 2: SSH Key Injection

1. Initial Steps: Steps 1-3 identical to the previous scenario.
2. Weaponization: The attacker uses the file write primitive to write an attacker-controlled SSH public key to /root/.ssh/authorized_keys (or the equivalent path for the service account the Veeam processes run as).
3. Execution: The attacker initiates an SSH connection to the Veeam server using the corresponding private key.
4. Impact: The attacker gains persistent, interactive server access that may evade detection more effectively than cron-based implants, as SSH sessions from administrative workstations may blend in with normal administrative traffic.

Impact Assessment

The business impact of CVE-2026-32997 is severe for organizations running Linux-based Veeam Backup & Replication deployments. The vulnerability allows a low-privileged authenticated user (Backup Administrator) to escalate to arbitrary file write on the server, and potentially to full code execution.

The blast radius extends beyond the Veeam server itself. Backup infrastructure sits at a privileged position in most IT environments — it typically holds credentials to connect to vCenter, ESXi hosts, and virtual machines, and it contains the most sensitive data in the organization. An attacker who compromises the backup server can:

• Access and exfiltrate all backup data, including offsite copies that may be stored without the same encryption controls as primary storage.
• Use the backup server as a pivot point to reach the virtualization infrastructure, since backup servers often have network trust relationships with management networks.
• Deploy ransomware directly into backup repositories, corrupting the organization's ability to recover from the primary incident.

The CVSS subscores highlight the severity: high integrity impact (arbitrary file write allows tampering with system files) and high confidentiality impact (the write primitive can be chained with reading operations or used to plant exfiltration tools). The scope change (S:C) indicates that the compromised component (the backup application) impacts resources beyond its security scope, affecting the underlying Linux OS.

Detection Guidance

Sigma Rule

title: Veeam Backup Linux Arbitrary File Write Attempt
id: 3e4af91c-7dd1-47a8-a5e3-0e1111de3a42
status: experimental
description: Detects path traversal patterns in Veeam Backup & Replication Linux management requests indicating arbitrary file write attempts (CVE-2026-32997)
author: Valtersit Threat Intelligence
date: 2026/06/15
logsource:
  category: process_creation
  product: linux
detection:
  selection_veeam_process:
    Image|endswith:
      - '/veeam'
      - '/Veeam'
      - '/update'
  selection_suspicious_args:
    CommandLine|contains:
      - '../../'
      - '..%2f'
      - '/etc/'
      - '/root/'
      - '/var/spool/'
      - '/tmp/'
  condition: selection_veeam_process and selection_suspicious_args
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.32997

YARA Rule

rule CVE_2026_32997_Veeam_Arbitrary_File_Write {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal patterns in Veeam Backup & Replication configuration files or logs associated with CVE-2026-32997"
        date = "2026-06-15"
        cve = "CVE-2026-32997"
        severity = "high"
    strings:
        $path_trav1 = "../../"
        $path_trav2 = "..\\"
        $path_trav3 = "..%2f"
        $path_trav4 = "..%5c"
        $backup_const = "Backup Administrator"
        $linux_path1 = "/etc/"
        $linux_path2 = "/root/"
        $linux_path3 = "/var/spool/"
        $linux_path4 = "/tmp/"
        $veeam_fs_path = /\/backup\/[^"]*\.\.\//
    condition:
        uint16(0) == 0x5B7B and
        (any of ($path_trav*) or $veeam_fs_path) and
        (any of ($linux_path*) or $backup_const)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Veeam Backup & Replication Linux Arbitrary File Write Attempt (CVE-2026-32997)"; flow:established,to_server; content:"veeam"; http_uri; nocase; content:"../../"; distance:0; http_uri; content:"/etc/"; distance:0; http_uri; flowbits:set,veeam_file_write; classtype:attempted-admin; sid:2026329971; rev:1; metadata:cve CVE-2026-32997;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ process where event.type == "start" and process.name : ("veeam*", "setup*") ]
  [ file where event.type == "creation" and
      file.path : ("/etc/*", "/root/*", "/var/spool/*", "/tmp/*") and
      file.path : ("*../*", "*..%2f*") ]

Splunk SPL Query

index=linux earliest=-24h
  (source="/var/log/veeam*" OR sourcetype="veeam:backup")
  [| search "Backup Administrator" | fields src_ip]
| rex field=_raw "Path[=|: ]+(?<requested_path>[^\s\"']+)"
| where match(requested_path, "(\\.\\./|/etc/|/root/|/tmp/|/var/spool/)")
| table _time, host, src_ip, requested_path, action
| sort -_time

Wazuh OSSEC Rule

<group name="veeam,">
  <rule id="712055" level="15" frequency="3" timeframe="300">
    <if_sid>502</if_sid>
    <match>backend</match>
    <match>not verified</match>
    <match>path</match>
    <regex>\.\./|\.\.\\|\.\.%2f</regex>
    <description>CVE-2026-32997: Possible Veeam Backup & Replication Linux arbitrary file write attempt detected</description>
    <group>attack.privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). No vendor fix is currently available.

Immediate Mitigations:

1. Restrict access to the Veeam Backup & Replication management interface to trusted administrative networks only. Use firewall rules to block port 9419, 9440, and 443 from untrusted sources.
2. Implement strict network segmentation so that the backup infrastructure resides in a dedicated, isolated network segment with no direct internet exposure.
3. Limit the number of accounts granted the Backup Administrator role. Review existing accounts and revoke the role from any users who do not require it for daily operations.
4. Implement additional authentication controls (MFA) on all accounts with Backup Administrator privileges to reduce the risk of credential compromise.
5. Monitor and log all backup job creation and modification activities, and alert on unusual file path patterns.

Patch/Upgrade Steps:

1. Monitor Veeam's official advisory channels and security bulletins for an upcoming fix. Subscribe to Veeam security notifications.
2. When a patched version is released, test the update in a staging environment that mirrors production configuration.
3. Apply the patch to all Linux-based Veeam Backup & Replication servers during the maintenance window, following Veeam's upgrade documentation.

Long-Term Hardening:

1. Implement file integrity monitoring (e.g., OSSEC, Tripwire, AIDE) for critical system paths (/etc/, /root/, /var/spool/, /tmp/) to detect unauthorized file modifications.
2. Deploy a host-based intrusion detection system that can alert on anomalous file creation events outside of expected backup job activity.
3. Enforce the principle of least privilege across all backup-related roles. Review role assignments quarterly.
4. Encrypt backup data at rest and in transit to mitigate data exposure if the server is compromised.
5. Implement an identity and access management (IAM) solution to centralize authentication controls for the backup management interface.
6. Consider running the Veeam server as a non-root service account with restricted write permissions to further limit the impact of an arbitrary file write exploit.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-32997
2. Veeam Security Advisories (when available): https://www.veeam.com/kb-cve-2026-32997
3. MITRE ATT&CK Technique T1068: https://attack.mitre.org/techniques/T1068/
4. CWE-36 Absolute Path Traversal: https://cwe.mitre.org/data/definitions/36.html
5. CISA Known Exploited Vulnerabilities Catalog (monitor for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of the time of this writing, there is no confirmed evidence of active exploitation in the wild for CVE-2026-32997. The EPSS score of 0.00514 (40.9% percentile) suggests a moderate probability of exploitation activity in the near future, and the vulnerability's low barrier to exploitation (authenticated user, low complexity) makes it an attractive target for adversaries seeking to compromise backup infrastructure. Microsoft and other security vendors have historically reported targeted attacks against Veeam backup servers as a strategic intrusion vector, so this CVE warrants increased monitoring despite the lack of confirmed campaigns.