Four critical flaws in Veeam Backup & Replication v13, which could allow attackers to gain root-level access and execute code on backup systems, have been disclosed by Veeam Software.
The vulnerabilities were discovered during internal testing and resolved in build 13.0.1.1071, released on January 6, 2026.
The most dangerous flaw, CVE-2025-55125, allows Backup or Tape Operators to perform remote code execution (RCE) as root by creating a malicious backup configuration file, carrying a CVSS v3.1 score of 7.2 (High severity).
A second critical issue, CVE-2025-59470, allows operators to execute arbitrary code as the PostgreSQL user via malicious interval or order parameters, rated Critical with a CVSS score of 9.0.
Though technically critical, Veeam adjusted this to High severity due to role-based access controls.CVE-2025-59469 permits operators to write files with root privileges.
| CVE ID | Severity | CVSS Score | Vulnerability Details |
|---|---|---|---|
| CVE-2025-55125 | High | 7.2 | RCE as root via malicious backup config |
| CVE-2025-59468 | Medium | 6.7 | RCE as PostgreSQL user via password parameter |
| CVE-2025-59469 | High | 7.2 | Arbitrary file write as root |
| CVE-2025-59470 | Critical* | 9.0 | RCE as PostgreSQL user via interval/order parameter |
At the same time, CVE-2025-59468 allows backup administrators to achieve RCE as the PostgreSQL user through malicious password parameters.
All four vulnerabilities affect VBR 13.0.1.180 and earlier versions of 13 builds. Earlier versions (12.x and older) remain unaffected.
The vulnerabilities are particularly concerning because they target privileged operator roles commonly used to manage enterprise backup systems.
Once disclosed, attackers typically reverse-engineer patches to exploit unpatched deployments, making rapid updates essential.
Organizations running affected versions of Veeam Backup & Replication must upgrade immediately to build 13.0.1.1071 or later.
Veeam recommends following its Security Guidelines to restrict operator role assignments to trusted personnel only.
The company emphasizes that network segmentation and strong authentication policies should complement patch deployment.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
Four security flaws described in the supplied Apache Struts advisories could expose affected applications to…
A former infrastructure engineer has been sentenced to 32 months in federal prison for sabotaging…
A new GitHub Copilot CLI finding that could allow an attacker-controlled web page to guide…
Every function in a security operations center, from alert triage to incident response, depends on…
ASOS is investigating a cyber incident after customers received an unauthorized app notification claiming hackers…
Silver Springs, United States / Maryland, October 6th, 2026, CyberNewswire Aembit, the identity control plane…