EUVD Vulnerability Catalog
EUVD-2026-82875
Severity: CRITICAL
Base Score: 9.4
CVSS Version: 4.0
Vulnerability Description
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could bypass the cryptographic signature
verification step of a privileged support command by supplying a
specially formed access credential. Successful exploitation grants the
attacker an unrestricted root shell with full control over the Flex
appliance host and all hosted containers, completely compromising
confidentiality, integrity, and availability.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): High
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): High
▪
Subsequent Availability Impact (SA): High
Affected Vendors & Systems
Vendor
Cohesity
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
ENISA
EPSS Probability
0.2
Known Aliases
GHSA-h4hc-x5f6-wfc4
CVE-2026-28198
Published On
2026-09-18
Last Updated
2026-09-18