Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-28197

Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

CVSS 4.0 9.4 CRITICALCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-28197

Published

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-28197

Published

NetBackup Flex OS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Cohesity",
                    "product": "NetBackup Flex OS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "6.4",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON