Article Details
Scrape Timestamp (UTC): 2026-01-07 10:43:22.063
Source: https://thehackernews.com/2026/01/veeam-patches-critical-rce.html
Original Article Text
Click to Toggle View
Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication. Veeam has released security updates to address multiple flaws in its Backup & Replication software, including a "critical" issue that could result in remote code execution (RCE). The vulnerability, tracked as CVE-2025-59470, carries a CVSS score of 9.0. "This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter," it said in a Tuesday bulletin. According to Veeam's documentation, a user with a Backup Operator role can start and stop existing jobs; export backups; copy backups; and create VeeamZip backups. A Tape Operator user, on the other hand, can run tape backup jobs or tape catalog jobs; eject tapes; import and export tapes; move tapes to a media pool; copy or erase tapes; and set a tape password. In other words, these roles are considered highly privileged, and organizations should already be taking adequate protections to prevent them from being misused. Veeam said it's treating the shortcoming as "high severity" despite the CVSS score, stating the opportunity for exploitation is reduced if customers follow Veeam's recommended Security Guidelines. Also addressed by the company are three other vulnerabilities in the same product - All four identified vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier versions of 13 builds. They have been addressed in Backup & Replication version 13.0.1.1071. While Veeam makes no mention of the flaws being exploited in the wild, it's essential that users promptly apply the fixes, given that vulnerabilities in the software have been exploited by threat actors in the past.
Daily Brief Summary
Veeam has issued patches for multiple vulnerabilities in its Backup & Replication software, including a critical remote code execution flaw, tracked as CVE-2025-59470, with a CVSS score of 9.0.
The critical flaw allows Backup or Tape Operators to execute remote code as the postgres user by manipulating specific parameters, posing significant security risks.
Veeam's security update addresses four vulnerabilities affecting version 13.0.1.180 and earlier, urging users to upgrade to version 13.0.1.1071 to mitigate potential threats.
Despite the high CVSS score, Veeam states the exploitation risk is reduced if customers adhere to its Security Guidelines, emphasizing the importance of following best practices.
No active exploitation of these vulnerabilities has been reported, but the history of past threats exploiting similar flaws necessitates prompt action from users.
Organizations are advised to review their access controls, particularly for highly privileged roles like Backup and Tape Operators, to prevent misuse.
The update underscores the critical need for timely patch management to safeguard against potential exploitation by threat actors.