Code Execution Vulnerability in NetBackup Flex OS by Cohesity
CVE-2026-28197

9.4CRITICAL

Key Information:

Vendor

Cohesity

Status
Netbackup Flex Os
Vendor
CVE Published:
18 September 2026

What is CVE-2026-28197?

An authenticated low-privileged user with access to the NetBackup Flex OS management shell can manipulate input to execute privileged administrative commands, leading to arbitrary code execution with root-level permissions. This exploitation risk enables attackers to gain unrestricted control over the Flex appliance host and all associated containers, severely impacting the overall confidentiality, integrity, and availability of the system.

Affected Version(s)

NetBackup Flex OS 0 < 6.4

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28197
government-resource
https://github.com/cohesity/SecAdvisory/blob/master/COH-2...
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.