NetBackup Administration Console EUVD-2026-97121

Exploitation requires an attacker to deliver attacker-controlled input (typically a crafted URL/parameter) that the NetBackup Administration Console web interface reflects back without proper HTML neutralization, AND requires a victim with access to that web console to open/view the malicious content (UI:R) - realistically a backup administrator who is logged into the console. Limiting factors that reduce real-world risk: the mandatory user-interaction step (social engineering is required; it is not self-propagating or remotely automatable against the server), the low technical impact (session/browser-context compromise, not direct server code execution or data destruction), and that the issue is remediated in version 11.2, so only deployments running versions before 11.2 are affected. No special non-default product feature or configuration is cited as a precondition in the advisory.

This is a moderate-severity reflected/basic XSS (CWE-80, CVSS 6.1) whose signals are mostly consistent and point to a limited, interaction-dependent risk rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated-to-trigger flaw that nonetheless REQUIRES victim interaction (UI:R) and yields only low confidentiality and integrity impact with no availability impact - the scope change (S:C) reflects that the payload executes in the victim's browser/session rather than on the server itself. No EPSS score, CISA KEV entry, or public PoC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical weighting factor is that the affected component is an administration console: successfully phishing a logged-in NetBackup administrator could expose session-level data or let the attacker perform console actions in that user's context, which raises the real-world consequence above what the raw 6.1 suggests. Missing data to note explicitly: EPSS probability is absent (cannot gauge likelihood of mass exploitation), and KEV/PoC status is unconfirmed rather than confirmed-negative - treat 'no known exploitation' as 'none reported in provided sources,' not as a vendor guarantee.

An attacker crafts a URL (or input) containing a script payload that the NetBackup Administration Console web interface reflects without proper neutralization, then lures a backup administrator into clicking it (e.g., via a targeted phishing email). When the admin opens the link while authenticated to the console, the script executes in their browser session, allowing session/cookie theft or actions performed as that administrator. No public exploit code was identified at time of analysis, and exploitation hinges on the required user interaction.