Remote code execution affecting Veeam Backup & Replication
A critical vulnerability affecting Veeam would allow an authenticated attacker to remotely execute code in affected systems.
Description
Technical context and vulnerability details
Veeam Backup & Replication is a backup and recovery software developed by Veeam Software. It helps protect virtual machines and cloud environments, ensuring reliable backup and rapid data recovery in the event of an incident or data loss. This solution is affected by a critical vulnerability labeled CVE‑2025-59470, resulting from insufficient validation of query parameters provided by a user when performing backup management actions. Exploitation of this vulnerability would allow an authenticated attacker with the Backup Operator and Tape Operator roles to execute arbitrary code on affected systems by providing specially crafted parameters to Veeam Backup & Replication internal components. This vulnerability is classified critical with a severity score of 9.0 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Veeam Backup & Replication version 13.0.1.180 and all versions prior to 13.0.1.1071;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Veeam Backup & Replication to version 13.0.1.1071 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.