{"id":"CVE-2026-105477","kind":"vulnerability","aliases":["CVE-2026-105477"],"related":[],"title":"Veeam Agent for Linux: local privilege escalation to root on managed hosts","description":"A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.","summary":"Veeam Agent for Linux has a flaw that lets a local user escalate their privileges. Only installations managed by a Veeam Backup & Replication instance are affected, according to the NVD description.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","infrastructure","linux","self-hosted","veeam"],"not_affected_if":["not-managed-by-backup-replication","standalone-agent"],"how_to_check":"- Check the installed Veeam Agent for Linux version on each Linux host with `veeamconfig --version` (command assumed from Veeam product usage; sources do not confirm it)\n- Check whether the agent is managed by a Veeam Backup & Replication server (sources do not say how to verify this)","fix":"- Upgrade Veeam Agent for Linux to the fixed release named in the Veeam advisory (version unknown from the sources)\n- Review local accounts with shell access on managed Linux hosts until patched","status":"open","published_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:40+00:00","updated_at":"2026-10-27T17:34:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T17:34:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Veeam Agent for Linux to the fixed release named in the Veeam advisory (version unknown from the sources)\n- Review local accounts with shell access on managed Linux hosts until patched","reach":"local","title":"Veeam Agent for Linux: local privilege escalation to root on managed hosts","impact":"high","summary":"Veeam Agent for Linux has a flaw that lets a local user escalate their privileges. Only installations managed by a Veeam Backup & Replication instance are affected, according to the NVD description.","category":"infrastructure","nicknames":[],"who_cares":["veeam","linux","backup","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Local user gains elevated privileges on the Linux host","analyst_note":"Find the Veeam advisory for CVE-2026-105477 to confirm the fixed version, the exact affected builds and the local-only attack path.","how_to_check":"- Check the installed Veeam Agent for Linux version on each Linux host with `veeamconfig --version` (command assumed from Veeam product usage; sources do not confirm it)\n- Check whether the agent is managed by a Veeam Backup & Replication server (sources do not say how to verify this)","needs_analyst":true,"not_affected_if":["standalone-agent","not-managed-by-backup-replication"],"who_is_affected":"Linux hosts running Veeam Agent for Linux that are managed by a Veeam Backup & Replication instance. Standalone agent installations that are not managed by Backup & Replication are not affected, according to the description. Systems without the agent can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3263,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105477':15A,18A '-2026':14A,17A 'accord':52B 'affect':51B,81C 'agent':2A,27B,61C 'allow':64C 'backup':19B,47B,77C 'cve':13A,16A 'descript':56B 'escal':7A,38B,68C 'flaw':32B 'host':12A,24B 'infrastructur':20B 'instal':42B,70C 'instanc':49B,79C 'let':34B 'linux':4A,21B,29B,63C 'local':5A,36B,66C 'manag':11A,43B,73C 'nvd':55B 'privileg':6A,40B,67C 'replic':48B,78C 'root':9A 'self':23B 'self-host':22B 'user':37B 'veeam':1A,25B,26B,46B,60C,76C 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts running Veeam Agent for Linux that are managed by a Veeam Backup & Replication instance. Standalone agent installations that are not managed by Backup & Replication are not affected, according to the description. Systems without the agent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105477","severity":null,"published_at":"2026-10-27T17:16:55+00:00","modified_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}