Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN011
_____________________________________________________________________

DATE                : 08/01/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Veeam Backup & Replication
                          versions prior to 13.0.1.1071.

=====================================================================
https://www.veeam.com/kb4792
_____________________________________________________________________


Vulnerabilities Resolved in Veeam Backup & Replication 13.0.1.1071
KB ID: 	4792
Product: 	Veeam Backup & Replication | 13
Published: 	2026-01-06
Last Modified: 	2026-01-06


All vulnerabilities documented in this article were resolved in Veeam
Backup & Replication 13.0.1.1071.
Veeam Product Latest Version Download Page

Veeam Software Security Commitment
Veeam® is committed to ensuring its products protect customers from
potential risks. As part of that commitment, we operate a Vulnerability
Disclosure Program (VDP) for all Veeam products and perform extensive
internal code audits. When a vulnerability is identified, our team
promptly develops a patch to address and mitigate the risk. In line with
our dedication to transparency, we publicly disclose the vulnerability
and provide detailed mitigation information. This approach ensures that
all potentially affected customers can quickly implement the necessary
measures to safeguard their systems. It’s important to note that once a
vulnerability and its associated patch are disclosed, attackers will
likely attempt to reverse-engineer the patch to exploit unpatched
deployments of Veeam software. This reality underscores the critical
importance of ensuring that all customers use the latest versions of our
software and install all updates and patches without delay.


Issue Details
All vulnerabilities disclosed in this article affect Veeam Backup &
Replication 13.0.1.180 and all earlier version 13 builds.
Note: Previous versions of Veeam Backup & Replication (i.e., 12.x and
older) are not impacted by these vulnerabilities.


CVE-2025-55125

This vulnerability allows a Backup or Tape Operator to perform remote
code execution (RCE) as root by creating a malicious backup
configuration file.

Severity: High
CVSS v3.1 Score: 7.2
Source: Discovered during internal testing.


CVE-2025-59468

This vulnerability allows a Backup Administrator to perform remote code
execution (RCE) as the postgres user by sending a malicious password
parameter.

Severity: Medium
CVSS v3.1 Score: 6.7
Source: Discovered during internal testing.


CVE-2025-59469

This vulnerability allows a Backup or Tape Operator to write files
as root.

Severity: High
CVSS v3.1 Score: 7.2
Source: Discovered during internal testing.


CVE-2025-59470

This vulnerability allows a Backup or Tape Operator to perform remote
code execution (RCE) as the postgres user by sending a malicious
interval or order parameter.

Adjusted Severity*: High
CVSS Severity: Critical
CVSS v3.1 Score: 9.0
Source: Discovered during internal testing.

*Reason for Adjustment: The Backup and Tape Operator roles are
considered highly privileged roles and should be protected as such.
Following Veeam's recommended Security Guidelines further reduces the
opportunity for exploitability. Due to these factors affecting the
temporal and environmental vectors of CVSS, Veeam has adjusted its
response to this vulnerability to align with that of a High severity
rating.


Solution

These vulnerabilities were fixed starting with the following build:

    Veeam Backup & Replication 13.0.1.1071


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================