Loading vulnerability…
Authenticated RCE via Password Parameter in Veeam Backup & Replication
CVE-2025-59468 is an authenticated remote code execution vulnerability in Veeam Backup & Replication 13, affecting build 13.0.1.180 and earlier version 13 builds. A user with the Backup Administrator role can submit a malicious password parameter to execute arbitrary code as the postgres operating-system account. The specific vulnerable function and underlying injection mechanism have not been identified. The vulnerability has a CVSS score of 6.7 (Medium). Versions 12.x and older are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the backup server within the privileges of the postgres account. This could permit manipulation or corruption of the PostgreSQL database and disruption of backup operations. The vulnerability does not establish root-level execution or the ability to destroy immutable backup data.
If you can’t patch tonight, do this now.
Until patching is complete, restrict Backup Administrator assignments to essential trusted personnel, audit privileged accounts and credentials, and enforce strong authentication. Segment backup infrastructure and restrict management access to trusted systems. Monitor privileged activity and investigate unexpected backup failures, database issues, or server connectivity changes. These controls reduce exposure but do not replace the update.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication 13 installations to build 13.0.1.1071 or a later supported release containing the fix. The fixed build was released on January 6, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.