CVE-2026-28198 — Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

CVE-2026-28198

Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell PUBLISHED

Description (CNA)

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

Affected (CNA)

Vendor / product	Versions
Cohesity / NetBackup Flex OS	affected 0 before 6.4

CWE

CWE-347

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.