CVE-2025-59470

Published Jan 8, 2026

Last updated 13 hours ago

Veeam Backup & Replication

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59470 is a vulnerability identified in Veeam Backup & Replication software, specifically affecting version 13.0.1.180 and all prior builds within the version 13 series. This flaw enables an authenticated user with either "Backup Operator" or "Tape Operator" roles to achieve remote code execution (RCE) as the 'postgres' user. The exploitation occurs by manipulating and sending a malicious interval or order parameter within the system. Veeam has released an urgent security update, build 13.0.1.1071, to address this and other related vulnerabilities. It is important to note that earlier versions of Veeam Backup & Replication, such as 12.x and older, are not impacted by this specific issue.

Description: This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
Source: support@hackerone.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9
Impact score: 6
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Hype score: Not currently trending

References