What is the CVSS score of CVE-2025-63911?

CVE-2025-63911 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Tranzman are affected by CVE-2025-63911?

Cohesity TranZman Migration Appliance users running version 4.0 Build 14614 are vulnerable to authenticated command injection attacks that could allow attackers with valid credentials to execute…

Is there a public PoC exploit available for CVE-2025-63911?

Yes, a public proof-of-concept exploit is available for CVE-2025-63911. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2025-63911?

Within 24 hours: Inventory all Cohesity TranZman appliances and identify those running Build 14614; restrict administrative access to authorized personnel only and review recent access logs for suspicious activity. Within 7 days: Implement network segmentation to limit appliance access and disable remote access if not actively required; contact Cohesity support for patch availability timeline and workarounds. Within 30 days: Apply vendor patch immediately upon release; conduct security audit of migration operations and credentials for potential compromise.

Tranzman CVE-2025-63911

HIGH

OS Command Injection (CWE-78)

2026-03-03 cve@mitre.org

Command Injection Tranzman Cohesity

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 00:24 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 18:16 nvd

HIGH 7.2

DescriptionCVE.org

Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability.

AnalysisAI

Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability. [CVSS 7.2 HIGH]

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Tranzman. Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability.