How severe is CVE-2026-32997?

CVE-2026-32997 has a CVSS 4.0 base score of 8.6, rated high severity.

Is CVE-2026-32997 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-32997?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-32997 have an EU (EUVD) identifier?

Yes. CVE-2026-32997 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32713.

When was CVE-2026-32997 published?

CVE-2026-32997 was published on 2026-05-28 and last updated on 2026-06-17.

CVE-2026-32997

CVE-2026-32997 is a high-severity vulnerability with a CVSS 4.0 base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-36.

Key facts

Severity: High (CVSS 4.0 base score 8.6)
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-32713
Weakness: CWE-36
Published: 2026-05-28
Last modified: 2026-06-17

Description

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

Frequently asked questions

What is CVE-2026-32997?: A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
How severe is CVE-2026-32997?: CVE-2026-32997 has a CVSS 4.0 base score of 8.6, rated high severity.
Is CVE-2026-32997 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-32997?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-32997 have an EU (EUVD) identifier?: Yes. CVE-2026-32997 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32713.
When was CVE-2026-32997 published?: CVE-2026-32997 was published on 2026-05-28 and last updated on 2026-06-17.

References

https://www.veeam.com/kb4852

Other CWE-36 vulnerabilities

CVE-2023-3765 — Critical (CVSS 10.0): Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2025-34392 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL…
CVE-2025-0851 — Critical (CVSS 9.8): A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad…
CVE-2024-13161 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13160 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13159 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…

Browse all CWE-36 vulnerabilities →