Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-28198

Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

CVSS 4.0 9.4 CRITICALCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-28198

Published

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-28198

Published

NetBackup Flex OS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Cohesity",
                    "product": "NetBackup Flex OS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "6.4",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON