CVE-2025-59468
Published: 08 January 2026
Summary
CVE-2025-59468 is a critical-severity Command Injection (CWE-77) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 37.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-59468 is a command injection vulnerability (CWE-77) that allows a Backup Administrator to achieve remote code execution (RCE) as the postgres user by supplying a malicious password parameter. Published on 2026-01-08, it carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L), reflecting its critical severity due to network accessibility, low attack complexity, and significant impacts despite requiring high privileges. The vulnerability affects Veeam software components involving PostgreSQL interactions, as referenced in the vendor's knowledge base.
A Backup Administrator, possessing high-level privileges (PR:H), can exploit this flaw remotely over the network without user interaction. By crafting and sending a malicious password parameter, the attacker triggers command injection, resulting in RCE executed in the context of the postgres user. This yields high confidentiality and integrity impacts, a change in scope (S:C), and low availability disruption, potentially allowing unauthorized access to sensitive data or further system compromise within the affected environment.
Veeam has published mitigation guidance in knowledge base article KB4792 at https://www.veeam.com/kb4792, which security practitioners should consult for patching instructions, workarounds, and affected version details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1515
Vulnerability details
This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) in Veeam PostgreSQL components enables remote code execution as postgres user, directly mapping to T1210 (Exploitation of Remote Services) and T1059 (Command and Scripting Interpreter).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the command injection flaw in Veeam PostgreSQL interactions, eliminating the vulnerability through patching.
Enforces validation of the malicious password parameter input to prevent command injection leading to RCE as the postgres user.
Limits the privileges of the Backup Administrator role and postgres user, reducing the impact of successful RCE exploitation.