CVE-2025-59470

CRITICAL EPSS 70.8%

Published Jan 8, 20265mo ago · Modified Jun 17, 20261w ago

9.0 CVSS 3.1

Critical

Published Jan 8, 2026 5mo ago

Last Modified Jun 17, 2026 1w ago

Description

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

CVSS Details

Base Score

9.0

Exploitability

2.3

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability Low

Threat Intelligence

EPSS Exploit Probability

70.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-77 Command Injection Injection

Affected Products 1

Vendor	Product	Version	Range
veeam	veeam_backup_\&_replication	*	≥13.0.0.4967 – <13.0.1.1071

References 1

veeam.com https://www.veeam.com/kb4792

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.