Veeam Backup and Recovery vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Veeam Backup and Recovery: 5 record(s), with affected versions and fixes.
CVE-2025-59470
Critical · 9.0
CWE-77 Jan 8, 2026
Command Injection in Veeam Veeam Backup & Replication
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
CVE-2025-59469
Critical · 9.0
CWE-200 Jan 8, 2026
Exposure of Sensitive Information in Veeam Veeam Backup & Replication
This vulnerability allows a Backup or Tape Operator to write files as root.
CVE-2025-59468
Critical · 9.1
CWE-77 Jan 8, 2026
Command Injection in Veeam Veeam Backup & Replication
This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a
malicious password parameter.
CVE-2025-55125
Critical · 9.8
CWE-77 Jan 8, 2026
Command Injection in Veeam Veeam Backup & Replication
This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious
backup configuration file.
CVE-2024-40711
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-502 Sep 7, 2024
Veeam Backup and Replication Deserialization Vulnerability
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).