Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication

Summary: Veeam released security updates for Backup & Replication addressing four vulnerabilities, including CVE-2025-59470, a critical remote code execution flaw with a CVSS score of 9.0 that lets a Backup or Tape Operator execute code as the postgres user by sending a malicious interval or order parameter. All four flaws affect version 13.0.1.180 and all earlier 13 builds, and are fixed in version 13.0.1.1071.
Key Takeaway: The flaw requires only a Backup or Tape Operator role, which Veeam's own documentation describes as highly privileged, so an account already trusted to run jobs and move tapes becomes the path to code execution on your backup server. Veeam makes no mention of in-the-wild exploitation, but it notes vulnerabilities in this software have been exploited by threat actors before.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-59470
Related: ⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026