Veeam fixes multiple vulnerabilities in Backup and Replication

Veeam has released Veeam Backup and Replication 13.0.1.1071, addressing one critical, two high and one medium vulnerability. All version 13 builds up to this point are affected. The critical flaw, CVE-2025-59470 with CVSS 3.1 score 9.0, lets a Backup or Tape Operator achieve remote code execution as the postgres user via a malicious interval or order parameter. CVE-2025-55125 and CVE-2025-59469, both scored 7.2, let the same role execute code as root via a malicious backup configuration file and write files as root respectively. CVE-2025-59468, scored 6.7, lets a Backup Administrator execute code as the postgres user via a malicious password parameter.

What this means for your organisation

All four vulnerabilities require the attacker to already hold an operator or administrator role in the backup solution. That makes them less urgent than an unauthenticated flaw, but not harmless: the backup system is the last line of defence in a ransomware incident, and an attacker who has obtained an operator account can use these flaws to take full control of the server, and thereby of the ability to recover.

Berigo recommends

• Upgrade to Veeam Backup and Replication 13.0.1.1071.
• Review who actually holds Backup Operator, Tape Operator and administrator rights, and remove access that is not in use.
• Require multi-factor authentication and separate administrative accounts for access to the backup solution.
• Ensure at least one copy is immutable or offline, so recovery does not depend on the backup server being intact.

Source

• veeam.com