CVE-2025-59707 is a critical spoofing flaw in N2W backup software, scored CVSS 9.8, with potential remote code execution and theft of account credentials. N2W versions before 4.3.2, and 4.4.x before 4.4.1, are affected. Upgrade, then rotate the cloud credentials N2W holds.
What's affected
The NVD record says N2W before 4.3.2 and 4.4.x before 4.4.1 are affected. The weakness is CWE-290, authentication bypass by spoofing. The sibling record CVE-2025-59706 covers improper validation of API parameters in the same versions.
The vendor's advisory page and the 4.3.2 release notes are listed under Sources. I could not read their text, so the version facts come from the record.
How to check if you're exposed
Open the N2W console and read the version. Anything under 4.3.2 on the 4.3 line, or 4.4.x below 4.4.1, is in scope. Review exposure of the console and API to the internet through your cloud security groups.
Because the record mentions credential theft, also list the cloud accounts, roles and keys that N2W uses to take backups.
What to do now
- Upgrade to 4.3.2 or 4.4.1, following N2W's guide.
- Rotate the cloud credentials and roles N2W uses, starting with any long lived access keys.
- Restrict console and API access to trusted networks.
- Review cloud audit logs for actions taken by the N2W identities that you do not recognise.
- Apply the CVE-2025-59706 fix, which ships in the same releases.
Why it matters
The class is CWE-290. A spoofing flaw lets a caller pretend to be something it is, such as a trusted component or user, so the checks that rely on identity pass when they should not. The record connects this to code execution and credential theft.
What makes it serious is what N2W holds: credentials with permission to read and copy cloud data. If those are taken, the damage reaches beyond the backup tool. Rotating them after the patch is the step people skip, and it matters because a theft would leave no trace in the product after you upgrade. The KEV flag is false.
Quick check
Is patching enough?
Patching closes the flaw. Because the record mentions credential theft, rotate the credentials N2W holds as well, since the patch cannot undo an earlier theft.
Sources
- N2W security advisory update (referenced by the record)
- N2W 4.3.2 release notes (referenced by the record)
Last reviewed: 19 October 2026.
