Veeam resolves CVSS 9.0 RCE flaw and other security issues

Veeam has released patches for a critical RCE flaw in Backup & Replication, tracked as CVE-2025-59470 with a CVSS score of 9.0. The fix also addresses three additional vulnerabilities: CVE-2025-55125 (RCE as root via malicious backup, CVSS 7.2), CVE-2025-59468 (RCE as postgres via password, CVSS 6.7), and CVE-2025-59469 (file write as root, CVSS 7.2). The vulnerabilities affect the Backup & Replication software, and the fixes were delivered in Veeam Backup & Replication 13.0.1.1071.

The issues were discovered during internal testing, and the vendor noted that Backup and Tape Operator roles are highly privileged, which led to downgrading the overall severity of the RCE flaw. It remains unclear whether any of the flaws are being exploited in the wild, according to the advisory published by Veeam.