Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-59470 dropped. CVSS 9.0. RCE in Veeam B&R 13 via malformed interval/order params — executes as postgres. If you haven't patched VEEAM01.elomary.local yet, stop reading and go do that first. ⏬ Thread ⏬on what happened and how to lock it down. #CVE https://t.co/kWoMVioNnh
Post summary
The tweet announces CVE‑2025‑59470—an RCE in Veeam Backup & Replication 13 with CVSS 9.0—and urges users to apply the patch immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | veeam | veeam_backup_\&_replication | - | - | - |