CVE-2025-59469
Published: 08 January 2026
Summary
CVE-2025-59469 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-59469 is a vulnerability that allows a Backup or Tape Operator to write files as root. It affects Veeam software, as detailed in the vendor's knowledge base article. The issue is classified under CWE-200 and carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L). The CVE was published on 2026-01-08T17:15:48.183.
The vulnerability can be exploited by an authenticated attacker possessing Backup or Tape Operator privileges. Exploitation requires network access and is low in complexity with no user interaction needed. Successful attacks enable file writes as root, resulting in high confidentiality and integrity impacts, low availability impact, and a change in scope.
Veeam has published mitigation guidance in KB4792, which security practitioners should consult for patching instructions and workarounds.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1517
Vulnerability details
This vulnerability allows a Backup or Tape Operator to write files as root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables privilege escalation from operator role to root via file write abuse.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employs least privilege to ensure Backup or Tape Operator roles cannot perform root-level file writes, directly preventing exploitation.
Enforces approved access authorizations, blocking the improper root file write capability granted to Backup or Tape Operators.
Identifies and patches the specific flaw in Veeam software enabling root writes by Backup or Tape Operators per vendor guidance.