Loading vulnerability…
Root RCE in Veeam Backup & Replication via Malicious Backup Configuration
CVE-2025-55125 is an authenticated remote code execution vulnerability in Veeam Backup & Replication version 13, affecting build 13.0.1.180 and earlier version 13 builds. A user assigned the Backup Operator or Tape Operator role can create a malicious backup configuration file to execute arbitrary code as root, exceeding the intended privileges of those roles. The vulnerability has a CVSS v3.1 score of 7.2 (High). Versions 12.x and older are not affected. The specific vulnerable function and underlying implementation flaw are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits root-level compromise of the affected backup server. An authorized or compromised operator account can cross application privilege boundaries to control the host, potentially exposing sensitive information, altering system configuration, and disrupting backup and recovery operations.
If you can’t patch tonight, do this now.
Until patching is complete, restrict Backup Operator and Tape Operator assignments to essential trusted personnel and audit existing role assignments and credentials. Limit network access to backup infrastructure, enforce strong authentication, and tightly control backup configuration creation and modification. Monitor configuration changes and unusual backup job activity. These controls reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication version 13 installations to build 13.0.1.1071 or a later supported release containing the fix. Build 13.0.1.1071 was released on January 6, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.