Veeam has rolled out an urgent security update for its flagship Backup & Replication software to address a series of high-severity vulnerabilities in the version 13 branch.
The most alarming of these flaws could allow authenticated users to execute remote code with root-level privileges, effectively handing over complete control of the backup infrastructure to an attacker.
The vulnerabilities affect Veeam Backup & Replication version 13.0.1.180 and all prior builds in the v13 series.
Veeam has explicitly confirmed that customers still operating on the 12.x branch are not affected by these specific issues.
The Risk: From Operator to Root
Discovered during internal security testing, these flaws highlight a dangerous escalation path.
They allow users who already hold specific, limited roles, such as “Backup Operator” or “Tape Operator,” to expand their permissions.
While these roles are privileged, they are not intended to have complete administrative control over the underlying operating system. The vulnerabilities bridge that gap.
For instance, CVE-2025-55125 allows an operator to craft a malicious backup configuration file that triggers remote code execution (RCE) as the root user. Similarly, CVE-2025-59470 enables code execution as the postgres user by manipulating interval parameters.
Although one flaw carries a critical CVSS score of 9.0, Veeam has adjusted the practical severity rating to “High.”
This distinction is important: exploitation is not possible for an anonymous outsider. An attacker must first compromise an account with Backup or Tape Operator credentials to launch the attack.
However, in environments where insider threats or compromised lower-level credentials are a concern, the risk remains acute.
The following table details the specific CVEs addressed in this patch:
| CVE ID | Severity | CVSS Score | Description |
|---|---|---|---|
| CVE-2025-55125 | High | 7.2 | Allows Backup/Tape Operators to perform RCE as root via malicious configuration files. |
| CVE-2025-59468 | Medium | 6.7 | Enables Backup Admins to execute RCE as the postgres user using malicious password parameters. |
| CVE-2025-59469 | High | 7.2 | Permits Backup/Tape Operators to write arbitrary files as root, potentially compromising the system. |
| CVE-2025-59470 | High | 9.0 | Allows Backup/Tape Operators to execute RCE as the postgres user by manipulating interval parameters. |
Veeam is urging all customers currently running version 13 to update immediately to Build 13.0.1.1071, which fully resolves these vulnerabilities.
Administrators should download the patch directly from the official Veeam Knowledge Base (KB4738).
Beyond applying the software update, security teams should review their current user role assignments.
Ensuring that the “Backup Operator” and “Tape Operator” roles are assigned only to trusted personnel and enforcing least-privilege access remain critical defenses against privilege-escalation attacks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The most alarming of these flaws could allow authenticated users to execute remote code with root-level privileges, effectively handing over complete control of the backup infrastructure to an attacker.){kind=link}