Skip to main content

Veeam Backup Replication CVE-2025-59469

CRITICAL
Information Exposure (CWE-200)
2026-01-08 support@hackerone.com
Information Disclosure Veeam Backup Replication Veeam
9.0
CVSS 3.1 · Vendor: hackerone
Share

Severity by source

Vendor (hackerone) PRIMARY
9.0 CRITICAL
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Primary rating from Vendor (hackerone) · only source for this CVE.

CVSS VectorVendor: hackerone

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 08, 2026 - 17:15 nvd
CRITICAL 9.0

DescriptionCVE.org

This vulnerability allows a Backup or Tape Operator to write files as root.

AnalysisAI

Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file write is a severe privilege escalation with scope change.

Technical ContextAI

Operators can exploit the file handling mechanism (CWE-200) to write files with root ownership. Root file write enables cron jobs, SSH authorized_keys, or system binary replacement for persistent root access.

RemediationAI

Apply Veeam patches. Audit operator-level account activity.

More in Veeam Backup Replication

View all
CVE-2024-40711 CRITICAL POC
9.8 Sep 07

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
CVE-2020-15518 HIGH POC
8.8 Jul 03

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
CVE-2026-21708 CRITICAL
9.9 Mar 12

Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as
CVE-2026-21667 CRITICAL
9.9 Mar 12

A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
CVE-2026-21666 CRITICAL
9.9 Mar 12

Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
CVE-2026-21669 CRITICAL
9.9 Mar 12

Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
CVE-2025-48983 CRITICAL
9.9 Oct 31

Remote code execution in the Mount service of Veeam Backup & Replication allows any authenticated domain user to execute
CVE-2025-55125 CRITICAL
9.8 Jan 08

Remote code execution as root in Veeam Backup & Replication allows an authenticated Backup Operator or Tape Operator to

CVE-2024-29849 CRITICAL
9.8 May 22

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

CVE-2022-26501 CRITICAL
9.8 Mar 17

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
CVE-2021-35971 CRITICAL
9.8 Jun 30

Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
CVE-2026-21671 CRITICAL
9.1 Mar 12

Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2025-59469 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy