CVE-2025-59470: Command Injection
Published Jan 8, 2026
·Updated
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
Affected Software
1 affected component
Veeam Veeam Backup \& Replication>=13.0.0.4967<13.0.1.1071
Event History
Feb 19, 2024
News Published
via The Register·01:29 AM
Mar 11, 2024
News Published
via The Register·04:28 AM
Jun 17, 2024
News Published
via The Register·01:59 AM
Nov 25, 2024
News Published
via The Register·01:30 AM
Feb 17, 2025
News Published
via The Register·02:25 AM
Mar 16, 2025
News Published
via The Register·10:58 PM
Mar 30, 2025
News Published
via The Register·10:45 PM
Jun 23, 2025
News Published
via The Register·12:33 AM
Nov 9, 2025
News Published
via The Register·10:34 PM
Nov 16, 2025
News Published
via The Register·11:05 PM
Nov 23, 2025
News Published
via The Register·10:46 PM
Dec 1, 2025
News Published
via The Register·12:05 AM
Dec 8, 2025
News Published
via The Register·12:10 AM
Dec 14, 2025
News Published
via The Register·11:26 PM
Dec 21, 2025
News Published
via The Register·10:34 PM
Jan 7, 2026
News Published
via BleepingComputer·01:06 PM
News Published
via BleepingComputer·01:06 PM
Jan 8, 2026
CVE Published
via MITRE·04:18 PM
Data Sourced
via MITRE·04:18 PM
DescriptionSeverity
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2026
News Published
via The Register·11:43 PM
Feb 8, 2026
News Published
via The Register·10:25 PM
News Published
via The Register·10:28 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-59470?
CVE-2025-59470 has a critical severity level due to its potential for remote code execution.
2
How do I fix CVE-2025-59470?
To fix CVE-2025-59470, update to Veeam Backup & Replication version 13.0.1.1072 or later.
3
Who is affected by CVE-2025-59470?
CVE-2025-59470 affects Veeam Backup & Replication versions 13.0.0.4967 to 13.0.1.1071.
4
What type of attack does CVE-2025-59470 enable?
CVE-2025-59470 enables a Backup Operator to perform remote code execution attacks.
5
How is CVE-2025-59470 exploited?
CVE-2025-59470 can be exploited by sending a malicious interval or order parameter to execute arbitrary code.