EUVD-2026-82875
GHSA-h4hc-x5f6-wfc4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management shell (AV:N) with an existing low-priv account (PR:L); signature bypass escalates beyond the shell's security scope to host/container root, so S:C with full C/I/A:H.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
3DescriptionCVE.org
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.
AnalysisAI
Root shell compromise of NetBackup Flex OS appliances is possible for authenticated, low-privileged users who have access to the NetBackup Flex OS management shell. By supplying a specially formed access credential, such a user can bypass the cryptographic signature verification step of a privileged support command (CWE-347), gaining unrestricted root control over the Flex appliance host and all hosted containers, with complete confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, low-privileged account with access to the NetBackup Flex OS management shell (PR:L) - not exploitable by fully unauthenticated remote attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-severity issue whose vendor CVSS 4.0 score of 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) is well-justified: a low-privileged authenticated user escalates to an unrestricted root shell owning the host and every hosted container. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in Cohesity SecAdvisory COH-2026-0001 at https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md; patch availability is per vendor advisory, but no exact fixed version was provided in the input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis; within 24 hours, restrict access to the NetBackup Flex OS management shell to only essential personnel and enable verbose logging of all privileged support command executions; within 7 days, audit all accounts with management shell access to enforce least privilege, implement network segmentation to isolate backup appliances, and deploy monitoring for signature verification bypass attempts; within 30 days, apply the vendor patch as soon as it is released and conduct a compromise assessment to detect any unauthorized root access.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today