Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication

Veeam has released security updates for its Backup & Replication software to fix a critical remote code execution vulnerability tracked as CVE-2025-59470, which carries a CVSS score of 9.0. This flaw could allow a Backup or Tape Operator to perform RCE as the postgres user by sending a malicious interval or order parameter, according to Veeam.

In its bulletin, the company explained that a Backup Operator can start and stop jobs, export and copy backups, and create VeeamZip backups, while a Tape Operator can run tape backup and catalog jobs, eject tapes, and move or erase tapes, underscoring the privileged nature of these roles.

Also addressed are three additional vulnerabilities in the same product: CVE-2025-55125 (CVSS 7.2) enables RCE as root via a malicious backup configuration file; CVE-2025-59468 (CVSS 6.7) allows RCE as the postgres user via a malicious password parameter; and CVE-2025-59469 (CVSS 7.2) permits writing files as root.

All four flaws affect Veeam Backup & Replication 13.0.1[.]180 and earlier 13 builds and have been fixed in version 13.0.1.1071; while Veeam says the risk is high, exploitation likelihood is reduced if customers follow the recommended security guidelines.