Veeam Patches Critical RCE Flaws in Latest Backup & Replication Release

Veeam has rolled out urgent security updates for its Backup & Replication software, addressing a cluster of high-severity vulnerabilities discovered in its latest version. The patches fix four flaws that could allow lower-level operators to execute remote code as root or as the postgres user, effectively handing full control of the backup infrastructure. The vulnerabilities target Version 13 (builds 13.0.1.180 and earlier), with Veeam noting that previous versions (12.x and older) are not impacted.

The most critical issue, CVE-2025-59470 (CVSS 9.0, adjusted to High), could let a Backup or Tape Operator achieve Remote Code Execution as the postgres user by supplying a malicious interval or order parameter. Two other flaws, CVE-2025-55125 (CVSS 7.2) and CVE-2025-59469 (CVSS 7.2), allow code execution with system-level or root privileges via malicious backup configuration files or arbitrary file writes as root, respectively.

An additional medium-severity bug, CVE-2025-59468 (CVSS 6.7), can enable RCE as the postgres user by manipulating the password parameter, affecting the Backup Administrator role; organisations running Veeam Backup & Replication v13 are urged to upgrade to build 13.0.1.1071 to close these gaps.