EUVD-2026-32715
GHSA-x8w2-9wjv-3hv6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain tenant admin credentials on Comet server
-
DeliveryAccess branding configuration UI
-
ExploitSubmit crafted characters bypassing filtering
-
ExecutionTriggered during agent signing module run
-
PersistArbitrary code executes as privileged server user
-
ImpactPivot to connected backup agent endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already hold tenant administrator credentials on the Comet Backup server and reach the management interface that handles branding configuration; the malicious input is delivered through the branding settings that feed the backup agent signing module. CVSS Attack Complexity is High, indicating non-trivial conditions such as specific characters bypassing filtering or specific timing during agent build/signing. Note the conflict between the CVSS vector's PR:N and the description's 'authenticated tenant administrator' - treat exploitation as requiring valid tenant-admin authentication, not anonymous network access. Single-tenant deployments where only the server operator is a tenant admin are largely self-limiting; multi-tenant MSP/hoster deployments are the realistic target population. |
| Impact | Headline severity is high: CVSS 9.0 with network attack vector, no user interaction, Scope:Changed, and high impact to confidentiality, integrity, and availability. However, the signals conflict in an important way - the CVSS vector states PR:N (no privileges), while the description explicitly requires an 'authenticated tenant administrator,' so true preconditions are closer to PR:L/PR:H and the reachable attacker population is much smaller than a pure unauthenticated RCE. Attack Complexity is High (AC:H), which together with no public exploit identified at time of analysis and no CISA KEV listing suggests this is currently a serious but not commodity-exploited issue. EPSS data was not provided. Real-world priority is high for any MSP/hoster running multi-tenant Comet deployments, lower for single-tenant installations where the administrator already controls the server. |
| Exploit ScenarioDerived | A reseller or rogue customer with tenant-administrator credentials on a hosted Comet Backup server logs into the management interface and submits crafted characters in the branding configuration that is consumed by the backup agent signing module. When the server next builds or signs an agent, the injected payload executes as a privileged user on the Comet server, after which the attacker can pivot to connected backup agents on customer endpoints. No public exploit identified at time of analysis, but the vendor advisory describes the branding configuration as the entry point. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 28, 2026
Remote code execution in Comet Backup server allows a tenant administrator to inject arbitrary code into the backup agent signing module via insufficient character filtering, ultimately running code with elevated privileges on the Comet server and on connected backup agent devices. The vendor advisory links the issue to the branding configuration path, and no public exploit has been identified at time of analysis. Combined with a Scope:Changed CVSS:3.1 score of 9.0, successful exploitation pivots from a single tenant context into the underlying server and downstream endpoints.
Earlier versions of this analysis (2)
Remote code execution in Comet Backup server allows a tenant administrator to inject and execute arbitrary code as a privileged user by abusing insufficient character filtering in the backup agent signing module. The flaw stems from the branding configuration handling per the vendor advisory and propagates from the server to connected backup agent devices, yielding a scope-changing compromise across the managed fleet. No public exploit identified at time of analysis, but the 9.0 CVSS and scope change make this a high-priority patching event for multi-tenant deployments.
Remote code execution in Comet Backup server enables a tenant administrator to inject arbitrary code through the backup agent signing module due to insufficient character filtering, executing under the context of a more privileged user. The flaw carries CVSS 9.1 with a scope change, meaning compromise of the backup server can propagate to connected backup agents on managed devices. No public exploit identified at time of analysis, and the issue has been disclosed via the WebPros/Comet support advisory referenced in the input.
RemediationAI
Patch available per vendor advisory - upgrade the Comet server to the fixed build listed at https://support.cometbackup.com/hc/en-us/articles/40655100268439--CVE-2026-32999-RCE-on-Comet-Server-via-branding-configuration; the exact fixed version is not independently confirmed from the provided data and should be taken from that advisory. Until patched, restrict who can log in as a tenant administrator, audit existing tenant admin accounts for unexpected users, and avoid delegating tenant-admin rights to untrusted resellers or customers, recognizing that this limits the legitimate self-service branding workflow. As a defensive control, review and constrain the branding configuration values currently stored for each tenant for unexpected characters or payloads, and rotate any signing keys or credentials that may have been exposed on the server. Place the Comet server's management interface behind VPN/SSO and IP allowlisting to reduce the attack surface, accepting that this may break remote tenant self-service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Comet Backup is a multi-tenant backup platform (cpe:2.3:a:webpros:comet_backup) where the central server distributes signed agents to client devices. The root cause class is CWE-94 (Improper Control of Generation of Code), here manifesting as insufficient character sanitization in the module that signs/builds backup agents - tenant-supplied branding values appear to flow unfiltered into a code or template context used during agent generation. Because signed agents are trusted and pushed to connected endpoints, injection at this layer breaks the trust boundary between a tenant and the server, which is reflected in the CVSS Scope:Changed (S:C) designation.
Know when Comet Backup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
Executive ViewAI
Comet Backup server contains a critical remote code execution vulnerability allowing tenant administrators to execute arbitrary code with elevated privileges on backup servers and connected agent devices. This vulnerability directly threatens disaster recovery capabilities and the integrity of backup systems that protect critical organizational data. With no vendor patch currently available, immediate administrative access controls and monitoring are required to prevent exploitation.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: (1) Strictly limit tenant administrator roles to essential personnel with background verification; (2) Require multi-step approval workflows for branding configuration changes; (3) Enforce strict input validation and character filtering on all branding configuration inputs; (4) Enable comprehensive audit logging of administrative activities and branding modifications; (5) Segment Comet Backup infrastructure from production networks and monitor for anomalous outbound traffic; (6) Deploy endpoint detection and response (EDR) tools on systems hosting Comet Backup servers and agents; (7) Establish backup infrastructure-specific incident response procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB