Veeam Agent Flaw CVE-2026-32996 Lets Local Users Gain SYSTEM Privileges

·14 views

A high-severity privilege escalation vulnerability, CVE-2026-32996, has been discovered in Veeam Agent for Microsoft Windows, affecting version 13.0.1.2067 and earlier builds shipped with Veeam Backup & Replication 13. The flaw resides in the Veeam Endpoint Backup service, where a low-privileged local user can exploit improper session UID handling over a named pipe to inherit an elevated administrator context. Because the service logs valid session UIDs to a file readable by standard users, an attacker can replay a captured UID and execute commands as NT AUTHORITY\SYSTEM. Rated 7.3 (High) under CVSS v4, the vulnerability is reportedly being actively exploited in the wild, with public proof-of-concept code already available. Veeam has released a fix in Veeam Backup & Replication 13.0.2.29, which updates the agent to build 13.0.3.1220, and users are urged to upgrade immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Webflow only pastes its own elements; a developer built a way to paste SVG and HTML

Webflow's Designer accepts only its own elements on paste, so copying an icon from Figma or plain HTML and CSS into it does nothing. The usual workaround, a Code Embed, works but is a black box whose contents cannot be selected, classed, or styled in the Style panel. The developer behind devpack built SVG to Webflow and HTML & CSS to Webflow tools, plus a browser extension that performs the conversion directly when pasting into the Designer. The approach works by inspecting the JSON Webflow places on the clipboard, which uses a flat list of nodes and a separate styles list, and then writing equivalent JSON that the Designer will paste. Because the modern Clipboard API cannot write that custom type, the developer relies on the older copy-event method, which remains the only viable option despite being deprecated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google overhauls YouTube's immersive view on Meta Quest and VR glasses

Google is reportedly redesigning the YouTube app's immersive viewing mode on Meta Quest and other VR glasses, aligning it more closely with Android XR and visionOS experiences. The shift suggests that watching video in headsets is moving from an occasional feature toward a routine habit. The article argues this matters beyond convenience, since sustained daily use makes it practical to layer vision-training activities onto existing viewing habits. It highlights Amblyotube, a Meta Quest app that sends different visual feeds to each eye during streamed content to support amblyopia (lazy eye) therapy. The app positions itself as an educational aid rather than a diagnostic or curative treatment, and is limited to users aged 13 and older.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Government agencies issue vendor questionnaire on post-quantum cryptography readiness

On November 4, the NSA, CISA, and Australia's ASD's ACSC published a 19-page guide of questions for buyers to ask software and hardware vendors about their post-quantum cryptography readiness. The document is a joint update of an earlier Australian version released in July. It follows NIST's final transition plan, which deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035. The guidance centers on a cryptographic bill of materials that inventories every algorithm, library, and configuration a product relies on, including those inherited from third parties. Buyers are encouraged to ask whether vendors can provide such an inventory and when post-quantum-ready releases will ship in time for deployment before 2030.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Proposal Urges Experience Decision Records to Align UX and Developers

The author proposes adopting Experience Decision Records, modeled on Architectural Decision Records, to capture both UX decisions and the reasons behind them. Without this, developers often lack context and either repeatedly ask the UX team for small rules or make inconsistent assumptions. Machine-readable records could also help AI-assisted coding and review tools check compliance with UX guidelines. The author acknowledges setup costs but suggests AI tools could extract existing decisions from emails, chats, and meeting notes to reduce effort. Human review would still be required, and the author argues the records would distribute knowledge more evenly and improve long-term consistency.

0 comments Read more at DEV Community