EUVD-2026-82877
GHSA-chmq-8gh3-838c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local authenticated shell access (AV:L/PR:L) with a simple crafted path (AC:L); rated C:H because the description states credential material can be exposed, with no integrity or availability impact.
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
2DescriptionCVE.org
An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.
AnalysisAI
Arbitrary file read in NetBackup Flex OS (versions before 6.4) lets an authenticated user who can reach the appliance's management shell read files outside the intended scope - including sensitive system configuration and credential material - by supplying a specially crafted path argument to a diagnostic command. The issue carries a CVSS 4.0 base score of 4.8 and is classified as CWE-347 (improper verification of cryptographic signature), with the advisory's associated tags pointing to an information-disclosure / JWT-style attack path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with access to the NetBackup Flex OS management shell (PR:L) and local interaction with the appliance (AV:L) - it is not remotely exploitable over the network without such access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update NetBackup Flex OS to 6.4 or later, which is the first release outside the affected range and applies the vendor fix per advisory COH-2026-0001 (https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md); the CVE record is also available at https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28199. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today