Critical SEVERITY — Vulnerability

CVE-2025-59470 — This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a mal

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

Platform
Veeam Backup & Replication
CVE Record
CVE-2025-59470
CVSS Score
9.0/10
Published
08 January 2026
Views
3
Primary source: Review the official advisory at nvd.nist.gov Kaynağa Git

Summary

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

Assessment

  • CVE: CVE-2025-59470
  • CVSS base score: 9
  • Vector: CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:L
  • Source: NVD record

References

Actions

  • Verify affected systems in inventory
  • Apply the vendor patch during a maintenance window
  • Restrict access at the network layer until the patch is applied
veeam backup \& replication *

Veeam Backup & Replication — Related Advisories

VIEW ALL →