CVE-2025-55125
Published: 08 January 2026
Summary
CVE-2025-55125 is a high-severity Command Injection (CWE-77) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the command injection vulnerability by requiring timely application of Veeam patches as specified in KB4792.
Prevents command injection (CWE-77) by validating and sanitizing malicious backup configuration file inputs before processing.
Reduces privilege escalation risk by enforcing least privilege on Backup Operator role and backup processes to limit root access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in backup config file directly enables local privilege escalation from operator role to root via arbitrary code execution.
NVD Description
This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.
Deeper analysisAI
CVE-2025-55125 is a command injection vulnerability (CWE-77) that allows a Backup or Tape Operator to achieve remote code execution as root by creating a malicious backup configuration file. The vulnerability affects Veeam Backup & Replication software, as detailed in the vendor's knowledge base. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high impact with low complexity and privileges required.
An attacker with Backup or Tape Operator privileges can exploit this vulnerability locally by crafting and submitting a malicious backup configuration file, leading to arbitrary code execution with root privileges on the affected system. The low attack complexity and lack of user interaction requirement make it straightforward for a compromised or malicious operator role to escalate privileges and potentially compromise the entire backup infrastructure.
Veeam has published mitigation guidance in knowledge base article KB4792, available at https://www.veeam.com/kb4792, which security practitioners should consult for patching instructions and workarounds.
Details
- CWE(s)