Threat Intelligence Database

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

CVE-2026-28198 is a critical vulnerability in Cohesity NetBackup Flex OS that allows an authenticated, low-privileged user with access to the management shell to bypass cryptographic signature verification of a privileged support command. Exploiting this flaw grants the attacker unrestricted root shell access, compromising the entire appliance host and all hosted containers. This results in full control over confidentiality, integrity, and availability of the system.

CVE-2026-28197 is a critical vulnerability in Cohesity NetBackup Flex OS that allows an authenticated, low-privileged user with access to the management shell to execute arbitrary code with root-level permissions by supplying specially crafted input to a privileged administrative command. This results in full compromise of the Flex appliance host and all hosted containers, affecting confidentiality, integrity, and availability.