Veeam has released security updates to address multiple flaws in its Backup & Replication software, including a “critical” issue that could result in remote code execution (RCE).
The vulnerability, tracked as CVE-2025-59470, carries a CVSS score of 9.0.
“This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter,” it said in a Tuesday bulletin.
According to Veeam’s documentation, a user with a Backup Operator role can start and stop existing jobs; export backups; copy backups; and create VeeamZip backups. A Tape Operator user, on the other hand, can run tape backup jobs or tape catalog jobs; eject tapes; import and export tapes; move tapes to a media pool; copy or erase tapes; and set a tape password.
In other words, these roles are considered highly privileged, and organizations should already be taking adequate protections to prevent them from being misused.
Veeam said it’s treating the shortcoming as “high severity” despite the CVSS score, stating the opportunity for exploitation is reduced if customers follow Veeam’s recommended Security Guidelines.
Also addressed by the company are three other vulnerabilities in the same product –
- CVE-2025-55125 (CVSS score: 7.2) – A vulnerability that allows a Backup or Tape Operator to perform RCE as root by creating a malicious backup configuration file
- CVE-2025-59468 (CVSS score: 6.7) – A vulnerability that allows a Backup Administrator to perform RCE as the postgres user by sending a malicious password parameter
- CVE-2025-59469 (CVSS score: 7.2) – A vulnerability that allows a Backup or Tape Operator to write files as root
All four identified vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier versions of 13 builds. They have been addressed in Backup & Replication version 13.0.1.1071.
While Veeam makes no mention of the flaws being exploited in the wild, it’s essential that users promptly apply the fixes, given that vulnerabilities in the software have been exploited by threat actors in the past.
