CVE-2026-108925: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) in Cohesity NetBackup Administration Console web interface

CVE-2026-108925 is an XSS vulnerability classified under CWE-80 affecting the Cohesity NetBackup Administration Console web interface. The flaw arises from improper neutralization of script-related HTML tags, which could allow attackers to execute arbitrary scripts in the context of the affected web interface. This vulnerability affects all versions before 11.2. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality and integrity but does not affect availability. There is no vendor advisory or patch information provided in the input data.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the NetBackup Administration Console web interface, potentially leading to limited confidentiality and integrity compromise. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or fix information is provided, users should monitor official Cohesity advisories for updates. Until a fix is available, consider limiting access to the affected web interface and applying any recommended security controls from the vendor.