What’s Vulnerable › Vulnerabilities

CVE-2026-28198: Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-18
• Weakness: CWE-347

Description

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

Affected products

• Cohesity NetBackup Flex OS: before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: Cohesity NetBackup Flex OS 6.4. Check the vendor advisory for mitigations.

References

• https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md
• https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198

Get alerted when CVE-2026-28198 or the next vulnerability affects your stack