Critical Remote Code Execution Vulnerabilities in Veeam Backup & Replication v13

Veeam Software disclosed and patched four critical vulnerabilities in its Backup & Replication v13 product, including a remote code execution (RCE) flaw rated CVSS 9.0 (CVE-2025-59470) that allows Backup or Tape Operators to execute arbitrary code as the PostgreSQL user by abusing interval or order parameters. Additional vulnerabilities include CVE-2025-55125, which enables RCE as root via a malicious backup configuration file, CVE-2025-59468 for RCE as the PostgreSQL user through a password parameter, and CVE-2025-59469 for arbitrary file write as root. These flaws were discovered during internal testing and have been addressed in build 13.0.1.1071, with Veeam urging immediate upgrades to mitigate risk.

The vulnerabilities specifically affect Veeam Backup & Replication v13.0.1.180 and earlier v13 builds, while versions 12.x and older are not impacted. Veeam highlighted that the affected operator roles are highly privileged, and following security guidelines can reduce exploitability, which led to some severity downgrades. There is currently no evidence of exploitation in the wild, but the risk of attackers reverse-engineering patches to target unpatched systems is significant. Organizations are advised to update promptly and restrict operator role assignments to trusted personnel to minimize exposure.