CVE-2026-108925: Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-11 · updated 2026-10-16
Weakness: CWE-80

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2. https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md

Affected products

Cohesity NetBackup Administration Console web interface: versions before 11.2

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

Get alerted when CVE-2026-108925 or the next vulnerability affects your stack