Netbackup Flex Os
Monthly
Root shell compromise of NetBackup Flex OS appliances is possible for authenticated, low-privileged users who have access to the NetBackup Flex OS management shell. By supplying a specially formed access credential, such a user can bypass the cryptographic signature verification step of a privileged support command (CWE-347), gaining unrestricted root control over the Flex appliance host and all hosted containers, with complete confidentiality, integrity, and availability impact. The vendor CVSS 4.0 score is 9.4 (PR:L, no user interaction); supplied intelligence does not indicate CISA KEV active exploitation or publicly available exploit code, so no public exploit identified at time of analysis.
Authenticated, low-privileged users with access to the Cohesity NetBackup Flex OS management shell can inject crafted argument input into a privileged administrative command and achieve arbitrary code execution as root, gaining unrestricted control of the Flex appliance host and every container it runs. The issue is network-reachable with low attack complexity and requires no user interaction, so the only real prerequisite is a valid low-privileged shell account; scoring 9.4 under CVSS 4.0 (assessed 9.1 under CVSS 3.1), it rates as a genuine high-priority vulnerability. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently limited to attackers who already hold credentials.
Arbitrary file read in NetBackup Flex OS (versions before 6.4) lets an authenticated user who can reach the appliance's management shell read files outside the intended scope - including sensitive system configuration and credential material - by supplying a specially crafted path argument to a diagnostic command. The issue carries a CVSS 4.0 base score of 4.8 and is classified as CWE-347 (improper verification of cryptographic signature), with the advisory's associated tags pointing to an information-disclosure / JWT-style attack path. Exploitation requires valid management-shell credentials and local access to the appliance, so it is not reachable over the network without an existing account; no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and vendor patches are available.
Root shell compromise of NetBackup Flex OS appliances is possible for authenticated, low-privileged users who have access to the NetBackup Flex OS management shell. By supplying a specially formed access credential, such a user can bypass the cryptographic signature verification step of a privileged support command (CWE-347), gaining unrestricted root control over the Flex appliance host and all hosted containers, with complete confidentiality, integrity, and availability impact. The vendor CVSS 4.0 score is 9.4 (PR:L, no user interaction); supplied intelligence does not indicate CISA KEV active exploitation or publicly available exploit code, so no public exploit identified at time of analysis.
Authenticated, low-privileged users with access to the Cohesity NetBackup Flex OS management shell can inject crafted argument input into a privileged administrative command and achieve arbitrary code execution as root, gaining unrestricted control of the Flex appliance host and every container it runs. The issue is network-reachable with low attack complexity and requires no user interaction, so the only real prerequisite is a valid low-privileged shell account; scoring 9.4 under CVSS 4.0 (assessed 9.1 under CVSS 3.1), it rates as a genuine high-priority vulnerability. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently limited to attackers who already hold credentials.
Arbitrary file read in NetBackup Flex OS (versions before 6.4) lets an authenticated user who can reach the appliance's management shell read files outside the intended scope - including sensitive system configuration and credential material - by supplying a specially crafted path argument to a diagnostic command. The issue carries a CVSS 4.0 base score of 4.8 and is classified as CWE-347 (improper verification of cryptographic signature), with the advisory's associated tags pointing to an information-disclosure / JWT-style attack path. Exploitation requires valid management-shell credentials and local access to the appliance, so it is not reachable over the network without an existing account; no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and vendor patches are available.