Veeam Patches Four Vulnerabilities in Backup & Replication

Veeam Software released a security update on Tuesday to address four vulnerabilities in its flagship Backup & Replication product, version 13, that could enable remote code execution by users with specific administrative privileges.

The flaws affect versions 13.0.1.180 and earlier, allowing individuals with roles such as Backup Administrator, Backup Operator or Tape Operator to execute malicious code or write files under elevated system privileges. Veeam classified the most severe issue, tracked as CVE-2025-59470 with a CVSS score of 9.0, as high severity rather than critical, citing the need for existing privileged access to exploit it. The company discovered the vulnerabilities through internal testing and emphasized that applying the patch to version 13.0.1.1071 would prevent potential misuse without disrupting operations.

In detail, CVE-2025-59470 permits a Backup or Tape Operator to run code as the postgres database user by submitting a malicious interval or order parameter during backup processes. Two other high-severity issues, CVE-2025-59125 and CVE-2025-59469, both with CVSS scores of 7.2, enable the same roles to achieve remote code execution as the root user through a...