Vulnerability · Published Sep 18, 2026 · Assigned by ENISA

CVE-2026-28198Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

High 8.8

In plain English

A high-severity security flaw in NetBackup Flex OS from Cohesity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

Affected products (as reported)

Vendor	Product	Versions
Cohesity	NetBackup Flex OS	0 – before 6.4

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198 government-resource
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md vendor-advisory