Description
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could supply a specially crafted input to a
privileged administrative command, causing it to execute arbitrary code
with root-level permissions. Successful exploitation grants the attacker
unrestricted control over the Flex appliance host and all hosted
containers, fully compromising confidentiality, integrity, and
availability.
Published: 2026-09-18
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Root-level code execution
Action: Restrict Access
AI Analysis

Impact

A crafted argument supplied by an authenticated low‑privileged user in the NetBackup Flex OS management shell can mislead a privileged administrative command into executing arbitrary code as root. This elevates the user to full control of the appliance host and all hosted containers, thereby compromising confidentiality, integrity, and availability.

Affected Systems

Cohesity NetBackup Flex OS is the affected product. No specific version information is provided in the advisory.

Risk and Exploitability

The CVSS score of 9.4 indicates very high severity. The EPSS score of 0.0037 indicates a very low likelihood of exploitation, and the vulnerability is not yet listed in CISA KEV. An attacker needs only local, authenticated access to the management shell and can exploit the flaw by passing a malicious argument to a privileged command, yielding unrestricted root privileges.

Generated by OpenCVE AI on September 19, 2026 at 19:57 UTC.

Remediation

Vendor Workaround

Restrict management shell access to authorized administrators only. No compensating control fully eliminates the risk; upgrading is required.

OpenCVE Recommended Actions

  • Restrict management shell access to authorized administrators only, ensuring low‑privileged users cannot reach the shell.
  • Disable or remove the management shell for users who do not require it, applying the principle of least privilege.
  • When a patch or updated product version is released by Cohesity, apply the update as soon as possible to eliminate the flaw.

Generated by OpenCVE AI on September 19, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 19 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Cohesity
Cohesity netbackup Flex Os
Vendors & Products Cohesity
Cohesity netbackup Flex Os

Fri, 18 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.
Title Privilege Escalation via Argument Injection in NetBackup Flex OS Shell
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Cohesity Netbackup Flex Os
cve-icon MITRE

Status: PUBLISHED

Assigner: ENISA

Published:

Updated: 2026-09-18T14:31:44.840Z

Reserved: 2026-02-25T14:02:29.492Z

Link: CVE-2026-28197

cve-icon Vulnrichment

Updated: 2026-09-18T14:30:09.440Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T12:17:24.573

Modified: 2026-09-18T19:24:36.593

Link: CVE-2026-28197

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T22:29:48Z

Weaknesses
  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')