Critical

Arbitrary File Write as root in Veeam Backup & Replication

IdentifiersCVE-2025-59469CWE-73

CVE-2025-59469 is a high-severity privilege-escalation flaw in Veeam Backup & Replication affecting version 13.0.1.180 and earlier 13.x builds. The issue allows a user assigned the Backup Operator or Tape Operator role to write arbitrary files with root privileges on the Veeam server, escaping the intended privilege boundaries of those roles. Publicly provided source material does not identify the exact vulnerable function or code path, but it consistently describes the flaw as a root-level arbitrary file write reachable by these operator roles. Veeam states that versions 12.x and older are not affected.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a Backup Operator or Tape Operator to create or overwrite files as root on the backup server. This can enable privilege escalation to full system compromise, tampering with application or system files, persistence, disruption of backup operations, and potential follow-on code execution depending on what files are written and where. Because the affected product is backup infrastructure, compromise can materially affect recovery operations and the integrity of protected environments.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict Backup Operator and Tape Operator assignments to only highly trusted personnel, review and reduce privileged role membership, isolate the Veeam server from untrusted networks, enforce strong authentication including MFA for administrative access, and closely monitor audit logs and backup-system activity for anomalous file changes or operator actions. Following Veeam security guidelines and limiting access to the backup server to essential personnel will reduce exposure until patching is completed.

Remediation

Patch, then assume compromise.

Upgrade Veeam Backup & Replication to version 13.0.1.1071 or later. Veeam states this build fixes CVE-2025-59469 along with related vulnerabilities in version 13.0.1.180 and earlier 13.x builds. Versions 12.x and older are reported as not impacted.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Veeam SoftwareVeeam Backup & Replicationapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

blackpoint cyberNews

Feb 11, 2026

Vulnerability Review - January 2026 - Blackpoint

Privilege escalation vulnerability in Veeam Backup & Replication addressed in updates; not reported actively exploited.

rescana blogNews

Jan 11, 2026

Critical RCE Vulnerability (CVE-2025-59470) in Veeam Backup & Replication: Patch Released to Prevent Exploitation

A vulnerability in Veeam Backup & Replication that allows arbitrary file write as root.

ctoatncsc substackNews

Jan 10, 2026

CTO at NCSC Summary: week ending January 11th

A post-authentication arbitrary file write vulnerability in Veeam (per linked Veeam KB), enabling a Backup or Tape Operator to write files as root.

secpod blogNews

Jan 9, 2026

Severe Veeam Backup Vulnerability Could Lead to Code Execution

A vulnerability in Veeam Backup & Replication that allows file write as root.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5