CVE-2026-28198

Summary

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

Affected Software

Weaknesses

• CWE-347: CWE-347 Improper verification of cryptographic signature

Workarounds

Restrict management shell access to authorized administrators only. No compensating control fully eliminates the risk; upgrading is required.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198
• https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md

• ←Previous
• Next→