CVE-2026-58068

Executive Summary

CVE-2026-58068 is a missing-authorization vulnerability (CWE-862) in Veeam Agent for Microsoft Windows that permits any local user to terminate arbitrary processes on the affected system. The flaw is exploitable by an attacker who already holds a low-privileged local session, meaning it is primarily a privilege-escalation and denial-of-service primitive rather than a remote entry point. Because no patch, fixed version, or vendor workaround is currently available, affected hosts remain exposed and require compensating controls until Veeam ships a fix.

Technical Analysis

The vulnerability is classified under CWE-862 (Missing Authorization). In practical terms, this means a security-relevant operation — here, the termination of processes — is exposed through a component of Veeam Agent for Microsoft Windows without an adequate authorization check verifying that the caller is entitled to perform that action. Any local user, including an unprivileged or standard user account, can invoke the exposed functionality and cause the targeted process to be terminated.

The NVD description is deliberately concise and does not disclose the specific executable, service name, IPC channel, named pipe, driver IOCTL, or RPC interface involved. Consequently, the precise request path that reaches the unprotected operation cannot be stated without fabrication. What can be stated with confidence from the description and the assigned weakness is the following:

1. The operation is process termination — not memory corruption, not code execution, not file read/write.
2. The authorization boundary that should gate the operation is absent or insufficient, allowing a non-privileged local principal to cross it.
3. The attack surface is local; there is no indication of a remote, unauthenticated vector.

The impact of an unauthorized process-termination primitive is not trivial. Terminating arbitrary processes on a Windows endpoint enables an attacker to (a) disable or degrade endpoint protection and monitoring agents, (b) interrupt backup operations performed by the Veeam agent itself, and (c) force restarts or service outages that can be leveraged to clear volatile state, evade logging, or force fallback to less-protected code paths. This is why the most defensible ATT&CK mapping is T1562.001 (Impair Defenses: Disable or Modify Tools): the arbitrary-kill capability is directly usable to take security tooling offline before a broader intrusion proceeds.

Given the absence of a disclosed CVSS vector, the vector in the metadata is a reasoned reconstruction: Local (AV:L), Low complexity (AC:L), Low privileges required (PR:L), No user interaction (UI:N), Unchanged scope (S:U), No confidentiality impact (C:N), No integrity impact (I:N), and High availability impact (A:H) — reflecting that the demonstrated effect is denial of service via process termination. This reconstruction must be treated as analytical, not vendor-published.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is therefore inferred at the vulnerability-class level from the NVD description and CWE-862; it does not assert any specific function, interface, or file name that has not been disclosed.

1. Reconnaissance and target identification. The attacker obtains a low-privileged foothold on a Windows host running a vulnerable Veeam Agent for Microsoft Windows. This foothold may come from a phishing payload, a malicious macro, a compromised service account, or any other means of achieving user-level code execution. The attacker enumerates the local Veeam agent installation and confirms the software is present.

2. Triggering the missing-authorization flaw. Leveraging the exposed functionality of the Veeam agent component that fails to enforce authorization, the attacker invokes the process-termination operation as a standard local user. Because the missing authorization check (CWE-862) is the root cause, the call succeeds without the attacker possessing administrative rights or the privileges that the operation should have required.

3. Payload and execution method (class level). The "payload" in this scenario is not code execution but a privileged side effect: the termination of a chosen process. The attacker selects targets by security value — endpoint detection and response agents, logging or telemetry services, or the Veeam agent's own protection-adjacent processes — and issues repeated termination requests.

4. Post-exploitation impact. With security and monitoring processes disabled or disrupted, the attacker gains operational freedom to perform follow-on activity with reduced detection fidelity. Backup integrity and availability may also be degraded, potentially affecting recoverability. The flaw can additionally be used for straightforward denial of service against critical host processes, causing instability or forced reboots. Critically, because no elevation to SYSTEM or administrative integrity is demonstrated by the description, this should be treated as a defense-evasion and availability-impact primitive — not a full local privilege-escalation-to-SYSTEM chain.

Impact Assessment

The business impact is concentrated in availability (availability: High in the reconstructed vector) and in security-control degradation. On endpoints where Veeam Agent for Microsoft Windows is deployed, an attacker with only user-level access can forcibly terminate processes, including — depending on what protections are in place — security agents and the backup workload itself. This undermines two pillars simultaneously:

• Confidentiality/Integrity: Directly, none are impacted by the disclosed behavior. Indirectly, both are at risk because disabling protective processes is a standard precursor to data theft, ransomware staging, and tampering.
• Availability: Directly impacted. Arbitrary process termination can crash applications, interrupt backup jobs, and force availability outages.

Blast radius. Any Windows endpoint, workstation, or server with a vulnerable Veeam Agent for Microsoft Windows installation is in scope. Because Veeam agents are frequently deployed broadly across fleets for backup and disaster recovery, the potential estate is large. The exposure requires a pre-existing local foothold, which moderates the remote risk but elevates the concern for environments where low-privileged access is common (VDI, multi-user RDP hosts, contractor laptops).

Severity. With no vendor-published CVSS, the most reasonable analytical characterization is a Medium-severity local issue (local access, low privileges, high availability impact), trending higher in environments where endpoint security tooling is a primary control. Absence from CISA KEV and no public exploit reduce immediate urgency but do not eliminate risk.

Detection Guidance

Sigma Rule

title: Potential Veeam Agent for Windows Unauthorized Process Termination (CVE-2026-58068)
id: 3f9c2a1e-7b64-4d8a-9e11-0c5a4e6b2d77
status: experimental
description: Detects non-privileged or anomalous process termination activity consistent with exploitation of CWE-862 in Veeam Agent for Microsoft Windows, where any local user can terminate arbitrary processes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-58068
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: windows
  category: process_creation
detection:
  selection_kill_utility:
    Image|endswith:
      - '\taskkill.exe'
    CommandLine|contains:
      - '/F'
      - '/f'
  selection_target_security:
    CommandLine|contains:
      - 'MsMpEng.exe'
      - 'SenseCncProxy.exe'
      - 'MsSense.exe'
      - 'CSFalconService.exe'
      - 'Veeam'
  selection_veeam_parent:
    ParentImage|endswith:
      - '\Veeam.EndPoint.Manager.exe'
      - '\VeeamAgent.exe'
  condition: selection_kill_utility and (selection_target_security or selection_veeam_parent)
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrative troubleshooting
  - Backup maintenance scripts
level: medium
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - cve.2026.58068

YARA Rule

rule CVE_2026_58068_Veeam_Agent_Missing_Authorization
{
    meta:
        description = "Detects references to Veeam Agent for Windows process-termination functionality associated with CVE-2026-58068"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-58068"
        cve = "CVE-2026-58068"

    strings:
        $veeam1 = "Veeam Agent for Microsoft Windows" ascii wide
        $veeam2 = "Veeam.EndPoint" ascii wide
        $term1  = "TerminateProcess" ascii wide
        $term2  = "OpenProcess" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        filesize < 80MB and
        (any of ($veeam*)) and
        (any of ($term*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-58068 Potential Veeam Agent for Windows Unauthorized Process Termination Activity"; flow:to_server,established; content:"Veeam Agent"; nocase; threshold: type both, track by_src, count 3, seconds 60; classtype:attempted-admin; sid:5806801; rev:1; metadata: cve CVE-2026-58068, created_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name : "taskkill.exe" and
  process.args : "*/*" and
  (
    process.args : "MsMpEng.exe" or
    process.args : "MsSense.exe" or
    process.args : "Veeam*" or
    process.parent.name : ("Veeam.EndPoint.Manager.exe", "VeeamAgent.exe")
  )

Splunk SPL Query

index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
(Image=*\\taskkill.exe OR Image=*\\Stop-Process*)
(CommandLine="*/F*" OR CommandLine="*/f*")
(CommandLine="*MsMpEng.exe*" OR CommandLine="*MsSense.exe*" OR CommandLine="*Veeam*")
| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, User, Image, CommandLine
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="windows,veeam,cve_2026_58068">
  <rule id="580680" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">taskkill.exe</field>
    <field name="win.eventdata.commandLine">/F</field>
    <description>CVE-2026-58068: Possible unauthorized process termination via Veeam Agent for Windows (CWE-862)</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations. Because no vendor fix exists, prioritize compensating controls. Restrict local interactive logon and lateral access so that low-privileged users cannot easily reach endpoints running the Veeam agent. Enforce least privilege and remove unnecessary local-user accounts. Apply application control (WDAC/AppLocker) to limit the utilities and scripts an unprivileged user can launch to interact with the agent. Increase monitoring of process-termination events targeting security and backup services, as covered in the detection rules above. Where feasible, isolate affected endpoints into tighter network segments.

2) Patch/upgrade steps. There is no fixed version to upgrade to at this time. Monitor the Veeam security advisories and the NVD entry for CVE-2026-58068 for the release of a patched build of Veeam Agent for Microsoft Windows. Once a fix is published, inventory all Windows endpoints running the agent, stage the update, and confirm the upgrade through your software inventory and agent version reporting. Treat any interim workaround Veeam publishes as temporary.

3) Long-term hardening. Standardize privileged access management so that ordinary users do not hold rights that could interact with backup or security subsystems. Adopt allowlisting for administrative tooling. Enable and centralize process-creation telemetry with alerting tuned to defense-evasion patterns. Maintain an asset inventory that maps every endpoint with a Veeam agent so patch cycles can be executed quickly. Verify backups are resilient to process tampering by testing recovery and by monitoring for abnormal termination of backup jobs.

References

• NVD — CVE-2026-58068: https://nvd.nist.gov/vuln/detail/CVE-2026-58068
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools: https://attack.mitre.org/techniques/T1562/001/
• Veeam Security Advisories (monitor for the patch advisory covering CVE-2026-58068): https://www.veeam.com/security-advisories.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-58068 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-58068 in any tracked source at the time of writing. EPSS has not yet scored this CVE, and no public PoC, exploit code, or Nuclei template exists.