Loading vulnerability…
Root-privileged arbitrary file write in Veeam Backup & Replication
CVE-2025-59469 is a privilege escalation vulnerability in Veeam Backup & Replication version 13, affecting build 13.0.1.180 and earlier version 13 builds. An authenticated user assigned the Backup Operator or Tape Operator role can write arbitrary files with root privileges, exceeding the role's intended permissions. The vulnerability is rated High with a CVSS score of 7.2. The vulnerable function and precise triggering input have not been disclosed. Versions 12.x and older are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises filesystem integrity by allowing an operator to write files with root privileges. Depending on the files targeted, this capability could enable further privilege escalation, compromise of the backup server, or disruption of backup operations. Direct arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patching is completed, restrict Backup Operator and Tape Operator assignments to essential trusted personnel, review existing role assignments and credentials, enforce strong authentication, and isolate backup infrastructure from untrusted networks. Monitor audit logs and backup jobs for unusual activity. These measures reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication version 13 installations to build 13.0.1.1071 or a later supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.