Four critical flaws in Veeam Backup & Replication v13, which could allow attackers to gain root-level access and execute code on backup systems, have been disclosed by Veeam Software.
The vulnerabilities were discovered during internal testing and resolved in build 13.0.1.1071, released on January 6, 2026.
The most dangerous flaw, CVE-2025-55125, allows Backup or Tape Operators to perform remote code execution (RCE) as root by creating a malicious backup configuration file, carrying a CVSS v3.1 score of 7.2 (High severity).
A second critical issue, CVE-2025-59470, allows operators to execute arbitrary code as the PostgreSQL user via malicious interval or order parameters, rated Critical with a CVSS score of 9.0.
Though technically critical, Veeam adjusted this to High severity due to role-based access controls.CVE-2025-59469 permits operators to write files with root privileges.
| CVE ID | Severity | CVSS Score | Vulnerability Details |
|---|---|---|---|
| CVE-2025-55125 | High | 7.2 | RCE as root via malicious backup config |
| CVE-2025-59468 | Medium | 6.7 | RCE as PostgreSQL user via password parameter |
| CVE-2025-59469 | High | 7.2 | Arbitrary file write as root |
| CVE-2025-59470 | Critical* | 9.0 | RCE as PostgreSQL user via interval/order parameter |
At the same time, CVE-2025-59468 allows backup administrators to achieve RCE as the PostgreSQL user through malicious password parameters.
All four vulnerabilities affect VBR 13.0.1.180 and earlier versions of 13 builds. Earlier versions (12.x and older) remain unaffected.
The vulnerabilities are particularly concerning because they target privileged operator roles commonly used to manage enterprise backup systems.
Once disclosed, attackers typically reverse-engineer patches to exploit unpatched deployments, making rapid updates essential.
Organizations running affected versions of Veeam Backup & Replication must upgrade immediately to build 13.0.1.1071 or later.
Veeam recommends following its Security Guidelines to restrict operator role assignments to trusted personnel only.
The company emphasizes that network segmentation and strong authentication policies should complement patch deployment.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…