CVE-2026-28199 — Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell

CVE-2026-28199

Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell PUBLISHED

Description (CNA)

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

Affected (CNA)

Vendor / product	Versions
Cohesity / NetBackup Flex OS	affected 0 before 6.4

CWE

CWE-347

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28199
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.