Veeam Backup And Recovery
13 CVEs affecting Veeam Backup And Recovery. Latest disclosed: 2026-01-08. Critical: 3, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59470 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. |
CVE-2025-59469 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to write files as root. |
CVE-2025-59468 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. |
CVE-2025-23121 | High | 8.8 | 2025-06-19 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
CVE-2025-23120 | High | 8.8 | 2025-03-20 | A vulnerability allowing remote code execution (RCE) for domain users. |
CVE-2024-40710 | High | 8.8 | 2024-09-07 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive inf… |
CVE-2024-40714 | High | 8.3 | 2024-09-07 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during… |
CVE-2024-39718 | High | 8.1 | 2024-09-07 | An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the… |
CVE-2025-55125 | High | 7.8 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file. |
CVE-2024-40713 | High | 7.8 | 2024-09-07 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) set… |
CVE-2024-40712 | High | 7.8 | 2024-09-07 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). |
CVE-2024-40709 | High | 7.8 | 2024-09-07 | A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. |
CVE-2025-24286 | High | 7.2 | 2025-06-19 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. |