Vulnerability · Published Sep 18, 2026 · Assigned by ENISA

CVE-2026-28197Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

High 8.8

In plain English

A high-severity argument injection in NetBackup Flex OS from Cohesity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 48.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.

Affected products (as reported)

Vendor	Product	Versions
Cohesity	NetBackup Flex OS	0 – before 6.4

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28197 government-resource
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md vendor-advisory