Veeam Backup & Replication CVE-2025-59468

Exploitation requires an authenticated Backup Administrator account on Veeam Backup & Replication (CVSS PR:H) - this is not remotely reachable by an anonymous attacker. The specific trigger is supplying a malicious 'password' parameter that is not neutralized before use in a command context (CWE-77), yielding command execution as the postgres OS user. No user interaction is needed (UI:N) and it is network-accessible to the management interface (AV:N), but the practical limiter is holding the privileged backup-admin role; the impact is amplified by the scope change to the OS-level postgres account. Defenders should restrict and monitor Backup Administrator membership and apply the KB4792 fix.

Signals are mixed and point to a serious-but-gated issue rather than a mass-exploitation emergency. The vendor CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven largely by the scope change (S:C) and full CIA impact from achieving RCE as the postgres OS user, but the PR:H requirement is the decisive limiter: exploitation demands an existing Backup Administrator - a highly privileged role in Veeam Backup & Replication. This is a privilege-escalation/command-injection pivot from an already-trusted application role to OS-level code execution, not an unauthenticated internet-facing break-in. Exploitation likelihood signals are low: EPSS is 0.11% (30th percentile), there is no CISA KEV listing, and no public exploit code was identified. There is no SSVC decision data in the input to reconcile. Note the tension between the 9.1 'critical' headline and the modest EPSS/absent KEV - the high base score reflects impact-if-exploited and scope change, while real-world urgency is tempered by the need to already hold Backup Administrator rights. Given Veeam's history as a ransomware target, this is still worth prompt patching for organizations where the backup console is broadly accessed, but it is not a drop-everything unauthenticated RCE.

An attacker who already holds Backup Administrator credentials (obtained via compromise, insider access, or over-provisioned delegation) submits a crafted password parameter containing shell/command metacharacters (CWE-77). The unsanitized value is passed into a command context tied to the embedded PostgreSQL configuration, executing attacker-controlled commands as the postgres OS user and enabling a pivot to the underlying backup server host and its stored data. No public proof-of-concept was identified at the time of analysis.