Several Code Execution Flaws Patched in Veeam Backup & Replication

Veeam has patched four code execution flaws in its Backup & Replication product, with the fixes applying to version 13.0.1.180 and earlier and introducing version 13.0.1.1071.

The vulnerabilities include CVE-2025-59470, which can be exploited by a user with ‘backup’ or ‘tape operator’ privileges to achieve remote code execution as the postgres user via specially crafted parameters, and CVE-2025-55125, CVE-2025-59469 and CVE-2025-59468, each granting the ability to run arbitrary code or write files as root given similar privileged access. One flaw allows remote code execution with ‘backup administrator’ privileges (CVE-2025-59468).

All four were discovered internally by Veeam, and there is no indication they have been exploited in the wild. According to the KEV catalog, four weaknesses in the product have been cited in recent years, and organisations are urged to apply the update to mitigate potential threats, as threat actors often target Veeam deployments. Written by Eduard Kovacs, 7 January 2026.