Description
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could bypass the cryptographic signature
verification step of a privileged support command by supplying a
specially formed access credential. Successful exploitation grants the
attacker an unrestricted root shell with full control over the Flex
appliance host and all hosted containers, completely compromising
confidentiality, integrity, and availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cohesity | NetBackup Flex OS | < 6.4 | 6.4 |
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198 government-resource
- https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md vendor-advisory