Threat database

CVE-2026-108925 is a medium severity vulnerability involving improper neutralization of script-related HTML tags (basic cross-site scripting) in the Cohesity NetBackup Administration Console web interface. It affects versions prior to 11.2. The vulnerability allows an attacker to inject script code that could be executed in the context of the affected web interface. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.