EUVD-2026-32715
GHSA-x8w2-9wjv-3hv6
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
AnalysisAI
Remote code execution in Comet Backup server allows a tenant administrator to inject arbitrary code into the backup agent signing module via insufficient character filtering, ultimately running code with elevated privileges on the Comet server and on connected backup agent devices. The vendor advisory links the issue to the branding configuration path, and no public exploit has been identified at time of analysis. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all Comet Backup tenant administrator role assignments and restrict branding configuration access to essential personnel; enable multi-factor authentication for all administrative access to Comet Backup systems. Within 7 days: Implement network segmentation to isolate Comet Backup infrastructure from production systems; configure enhanced audit logging for all branding configuration modifications and administrative actions; establish real-time alerts for suspicious administrator activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today